CVE-2026-75854: ArcadeDB Redis Wire-Protocol Plugin Missing Authentication
ArcadeDB versions before 26.8.1 contain a missing authentication vulnerability in the Redis wire-protocol plugin that allows unauthenticated attackers to read, write, and delete data. Attackers can connect to the Redis port and execute arbitrary commands against any database on the server without providing credentials, bypassing all security gates.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ArcadeDB Redis wire-protocol pluginto a version that resolves this vulnerability.Fixed in 26.8.1 - Compensating control
Until upgraded, prevent untrusted clients from reaching the ArcadeDB Redis port (the Redis wire-protocol plugin), e.g., restrict network access/firewall rules to trusted IPs only.
Event History
Frequently Asked Questions
Which deployments are exposed?
Any ArcadeDB server with the Redis wire-protocol plugin enabled and reachable on its Redis port is exposed. The issue affects versions before 26.8.1.
What does an attacker need to exploit this issue?
No credentials, privileges, or user interaction are required. An attacker only needs network access to the Redis port and can execute arbitrary commands against any database on the server.
What should be done if patching cannot happen immediately?
Upgrade ArcadeDB to version 26.8.1 or later. If upgrading is not immediately possible, restrict network access to the Redis port so untrusted attackers cannot connect.
How can I determine whether my environment is affected?
Determine whether the Redis wire-protocol plugin is enabled, whether its Redis port is reachable by untrusted networks, and whether the ArcadeDB version is earlier than 26.8.1. Such a configuration should be treated as affected because authentication is bypassed for Redis-protocol connections.