ArcadeDB Redis Wire-Protocol Plugin Missing Authentication

Versions reported by the vendor

Affected version ranges reported by the assigning authority (VulnCheck). Independent of NVD's CPE analysis and usually ahead of it.

• ArcadeData arcadedb

  • 26.8.1not affected
  • before 26.8.1affected · semver

Other highest-scoring records for the same primary product.

• CVE-2026-75852ArcadeDB MongoDB wire protocol authentication bypass cross-database
  37Monitor
• CVE-2026-75851ArcadeDB before 26.8.1 Authentication Bypass via Async Command
  37Monitor
• CVE-2026-75843ArcadeDB before 26.8.1 Privilege Escalation via gRPC Transaction
  37Monitor
• CVE-2026-67342ArcadeDB before 26.7.2 Authorization Bypass via Database Handlers
  37Monitor
• CVE-2026-67341ArcadeDB before 26.7.2 Authorization Bypass via SQL DEFINE FUNCTION
  37Monitor
• CVE-2026-44221ArcadeDB: Cross-database authorization bypass and unsecured newly-created databases
  36Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

A function added for development or support ships to production without authentication. It often relies on the assumption that it is “only reachable from the internal network.”

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1// Added for the support team2app.post("/maintenance/reset", resetDevice);

1if (config.maintenanceEnabled) {2  app.post(3    "/maintenance/reset",4    requireSession, requireRole("admin"), resetDevice5  );6}

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.