A critical authentication bypass in ArcadeDB's MongoDB wire-protocol plugin lets unauthenticated attackers read, modify, and destroy data in any database exposed on port 27017.
What Is It
ArcadeDB versions before 26.8.1 fail to enforce SASL authentication on data commands handled by the MongoDB wire-protocol plugin. An attacker who can reach port 27017 can issue insert, find, update, delete, and create commands against any database on the instance without supplying credentials.
The flaw is classified as CWE-306 (Missing Authentication for Critical Function). VulnCheck, the assigning CNA, scored it CVSS 3.1 9.8 CRITICAL (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and CVSS 4.0 9.3 CRITICAL. Every exploitability factor is at its worst case: network-reachable, low complexity, no privileges, no user interaction.
Why It Matters
Authentication is not enforced on the data path, so per the advisory, exploitation appears to require little more than a MongoDB client pointed at the exposed port; no credentials, no chained bug, no victim interaction are described as necessary. Confidentiality, integrity, and availability impacts are all rated HIGH, meaning an attacker can exfiltrate records, tamper with them, or wipe them outright.
Critically, the bypass is cross-database: access is not scoped to a single target but extends to any database on the affected instance. CISA's SSVC evaluation marks the vulnerability as automatable: yes with technical impact: total: a profile consistent with bugs that lend themselves to opportunistic internet-wide scanning, though no such activity has been reported to date.
What's Vulnerable
- Vendor/Product: ArcadeData; ArcadeDB
- Package:
pkg:maven/com.arcadedb/arcadedb-mongodbw - Affected versions: all versions prior to 26.8.1
- Fixed version: 26.8.1 and later
- Exposure: instances running the MongoDB wire-protocol plugin listening on port 27017
Patch Status
Upgrade ArcadeDB to 26.8.1, which is marked unaffected. Where immediate patching is not possible, restrict network reachability of port 27017 to trusted hosts only; reachability of that listener is the primary exposure condition described in the available advisories, so limiting it should substantially reduce risk pending an upgrade.
This CVE is not currently listed in the CISA Known Exploited Vulnerabilities catalog, and CISA's SSVC record shows exploitation status "none" as of 2026-08-18. No KEV-mandated remediation deadline applies. The record was published 2026-08-18 and remains in "Received" status at NVD, so analysis may still change.
Sources
- NVD, CVE-2026-75852: https://nvd.nist.gov/vuln/detail/CVE-2026-75852
- ArcadeDB GitHub Security Advisory (GHSA-fq9c-x968-g278): https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-fq9c-x968-g278
- VulnCheck Advisory; ArcadeDB MongoDB Wire Protocol Authentication Bypass (Cross-Database): https://www.vulncheck.com/advisories/arcadedb-mongodb-wire-protocol-authentication-bypass-cross-database