CVE-2026-75852: ArcadeDB MongoDB wire protocol authentication bypass cross-database
ArcadeDB versions before 26.8.1 fail to enforce SASL authentication on data commands in the MongoDB wire-protocol plugin. Unauthenticated attackers can issue insert, find, update, delete, and create commands against any database by connecting to port 27017 without credentials.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ArcadeDB MongoDB wire-protocol pluginto a version that resolves this vulnerability.Fixed in 26.8.1 - Compensating control
Until ArcadeDB is upgraded, block unauthenticated access to port 27017 at the network layer (e.g., firewall/ACL) so clients cannot connect to the MongoDB wire-protocol plugin without credentials.
Event History
Frequently Asked Questions
Which deployments are realistically exposed?
Any ArcadeDB instance running a version before 26.8.1 is exposed if its MongoDB wire-protocol service on port 27017 is reachable by an attacker. No credentials or prior access are required.
What does an attacker need to exploit this?
An attacker only needs network access to port 27017. They can connect without credentials and issue insert, find, update, delete, and create commands against any database.
What should be done if patching cannot happen immediately?
Upgrade ArcadeDB to version 26.8.1 or later. If immediate patching is not possible, restrict network access to port 27017 so untrusted attackers cannot reach the MongoDB wire-protocol plugin.