Authentication Bypass in ArcadeDB Redis Plugin

Executive Summary

CVE-2026-75854 is a missing authentication vulnerability in ArcadeDB's Redis wire-protocol plugin. It allows unauthenticated attackers to connect to the Redis port and execute arbitrary commands on any database managed by the server without providing credentials. This bypasses all security controls since the plugin fails to verify user identity before processing commands.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if ArcadeDB's Redis port (default 6379) is exposed to the network. Use commands like 'netstat -tulnp | grep 6379' or 'ss -tulnp | grep 6379' to verify if the port is listening. Test unauthenticated access by connecting via 'redis-cli -h <target> -p 6379' and attempting commands like 'INFO' or 'KEYS *'.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability enables attackers to read, write, or delete data across all databases on the server. They can exfiltrate sensitive information, manipulate or corrupt data, and delete critical records without detection. The default configuration binds the Redis port to all network interfaces, making it remotely exploitable.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and access control. GDPR mandates strict access controls and data integrity, while HIPAA requires safeguards for protected health information. The lack of authentication and audit trails could lead to unauthorized data exposure, resulting in regulatory penalties.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade ArcadeDB to version 26.8.1 or later to patch the vulnerability. If upgrading is not possible, disable the Redis wire-protocol plugin by removing or commenting out its configuration. Restrict network access to the Redis port using firewalls or bind it to localhost only.

Useful 0 Not Useful 0