CVE-2026-75852
CriticalCVSS 9.8Summary
ArcadeDB versions before 26.8.1 fail to enforce SASL authentication on data commands in the MongoDB wire-protocol plugin. Unauthenticated attackers can issue insert, find, update, delete, and create commands against any database by connecting to port 27017 without credentials.
Risk Assessment
Lack of required authentication allows unauthorized access and manipulation of data, potentially leading to data security breaches.
Recommendation
Upgrade ArcadeDB to version 26.8.1 or later, which fixes this issue.
Original NVD description (English source)
ArcadeDB versions before 26.8.1 fail to enforce SASL authentication on data commands in the MongoDB wire-protocol plugin. Unauthenticated attackers can issue insert, find, update, delete, and create commands against any database by connecting to port 27017 without credentials.