A critical missing-authentication flaw in ArcadeDB's Redis wire-protocol plugin lets unauthenticated network attackers read, write, and delete data across every database on an affected server.
What Is It
CVE-2026-75854 is a missing authentication for critical function vulnerability (CWE-306) in the Redis wire-protocol plugin bundled with ArcadeDB. Any attacker able to reach the exposed Redis port can connect and execute arbitrary commands against any database on the server without supplying credentials, bypassing all of ArcadeDB's security gates.
The flaw carries a CVSS v3.1 base score of 9.8 (Critical) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. A separate CVSS v4.0 assessment scores it 9.3 (Critical). It was disclosed by VulnCheck and published on 2026-08-18.
Why It Matters
The preconditions are as low as they get: network attack vector, low attack complexity, no privileges, and no user interaction. There is no credential to steal or phish; reaching the port is the whole exploit chain.
Impact is full-spectrum. Confidentiality, integrity, and availability are all rated HIGH, meaning an attacker can exfiltrate stored data, tamper with records, or destroy databases outright. Because access is not scoped to a single database, one exposed port compromises everything hosted on that instance. Given the trivial exploitation path, internet-facing deployments warrant treatment as potentially compromised pending investigation of logs and access records.
There is no CISA KEV entry for this CVE, and exploit maturity is listed as NOT_DEFINED in the CVSS v4.0 metrics; no confirmed active exploitation has been reported in the supplied data.
What's Vulnerable
- Vendor: ArcadeData
- Product: ArcadeDB (
pkg:maven/com.arcadedb/arcadedb-redis) - Affected: all versions before 26.8.1
- Not affected: 26.8.1 and later
Only deployments with the Redis wire-protocol plugin enabled expose the vulnerable listener.
Patch Status
Fixed in ArcadeDB 26.8.1. Upgrade to 26.8.1 or later. Where immediate patching is not possible, disabling the Redis plugin or firewalling its port off from untrusted networks should limit exposure until the upgrade lands. The NVD record was in "Received" status at time of writing, so CPE and analysis data may still change.