Authentication Bypass in ArcadeDB MongoDB Wire-Protocol Plugin

CVE-2026-75852

What is CVE-2026-75852?

ArcadeDB versions prior to 26.8.1 are vulnerable due to a failure to enforce SASL authentication on data commands within the MongoDB wire-protocol plugin. This flaw allows unauthenticated attackers to leverage unprotected access to issue various database commands such as insert, find, update, delete, and create by connecting to port 27017 without needing any credentials. Organizations using affected versions of ArcadeDB should take immediate action to secure their systems.

References