ArcadeDB MongoDB Wire Protocol SASL Authentication Bypass

Executive Summary

CVE-2026-75852 is an authentication bypass vulnerability in ArcadeDB's MongoDB wire-protocol plugin. It allows unauthenticated attackers to issue data commands like insert, find, update, delete, and create against any database by connecting to port 27017 without credentials. The issue occurs because the plugin fails to enforce SASL authentication on these commands despite implementing it.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if ArcadeDB versions before 26.8.1 are running and if the MongoDB wire-protocol plugin is enabled. Test unauthenticated access by connecting to port 27017 and attempting basic commands like find or insert without credentials.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability enables full compromise of confidentiality, integrity, and availability for all databases in affected ArcadeDB instances. Attackers can read, modify, or delete sensitive data without authentication. It also allows unauthorized creation of new databases or collections, leading to potential data loss or corruption.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates compliance requirements for data protection standards like GDPR and HIPAA, which mandate strict access controls and authentication for sensitive data. Unauthorized access to personal or health data could result in regulatory penalties, legal liabilities, and reputational damage due to non-compliance with data protection laws.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade ArcadeDB to version 26.8.1 or later to patch the vulnerability. If upgrading is not possible, disable the MongoDB wire-protocol plugin or restrict access to port 27017 using firewalls.

Useful 0 Not Useful 0