CVE-2026-75852 Overview
ArcadeDB versions before 26.8.1 fail to enforce Simple Authentication and Security Layer (SASL) authentication on data commands exposed through the MongoDB wire-protocol plugin. Unauthenticated attackers who reach TCP port 27017 can issue insert, find, update, delete, and create commands against any database on the server. The flaw is classified as Missing Authentication for Critical Function [CWE-306] and requires no user interaction or prior access.
Critical Impact
Any network-reachable ArcadeDB instance exposing the MongoDB wire protocol allows full read, write, and schema manipulation across every database without credentials.
Affected Products
- ArcadeDB versions prior to 26.8.1
- ArcadeDB MongoDB wire-protocol plugin
- Deployments exposing TCP port 27017
Discovery Timeline
- 2026-08-18 - CVE-2026-75852 published to NVD
- 2026-08-18 - Last updated in NVD database
Technical Details for CVE-2026-75852
Vulnerability Analysis
ArcadeDB ships an optional plugin that speaks the MongoDB wire protocol so MongoDB clients can query the database on port 27017. The plugin implements SASL handshakes for connection setup but does not verify that a successful authentication has occurred before dispatching data commands. As a result, an attacker who opens a TCP session and skips or fails the SASL exchange can still send fully formed MongoDB operation messages.
The plugin routes those operation messages to the underlying ArcadeDB engine as if they were issued by an authorized session. Attackers can enumerate databases, read arbitrary collections with find, alter records with update and delete, insert attacker-controlled data, and create new databases with create. Because authorization is not evaluated per command, the bypass affects every database served by the instance, not only the connection's default database.
Root Cause
The root cause is missing authentication enforcement on the command dispatch path of the MongoDB wire-protocol plugin [CWE-306]. Authentication state established through SASL is not required to be authenticated == true before command handlers execute, so unauthenticated sessions are treated equivalently to authenticated ones.
Attack Vector
Exploitation is remote and unauthenticated. An attacker connects to TCP port 27017 on a vulnerable ArcadeDB host using any MongoDB-compatible driver or a custom wire-protocol client. Without submitting valid credentials, the attacker issues standard MongoDB commands and receives valid responses. No user interaction, phishing, or existing foothold is required. Refer to the VulnCheck Advisory on ArcadeDB and the GitHub Security Advisory for protocol-level details.
Detection Methods for CVE-2026-75852
Indicators of Compromise
- Inbound TCP connections to port 27017 from unexpected external or internal sources.
- ArcadeDB logs showing MongoDB wire-protocol commands (find, insert, update, delete, create) without a preceding successful SASL authentication event.
- Unexpected creation of new databases or collections, or unexplained modifications to existing records.
- Sessions where SASL negotiation is absent or fails but data operations still return results.
Detection Strategies
- Inspect ArcadeDB server logs for command executions correlated with sessions that never completed SASL authentication.
- Deploy network detection rules that alert on MongoDB wire-protocol traffic to ArcadeDB hosts from sources outside an approved allowlist.
- Compare database schema and record counts against known-good baselines to surface unauthorized create, insert, or delete activity.
Monitoring Recommendations
- Enable verbose auditing on the ArcadeDB MongoDB plugin and forward events to a centralized log platform.
- Monitor port 27017 exposure using external attack surface scanning and internal port inventories.
- Alert on spikes in MongoDB command volume or in the number of distinct databases touched by a single session.
How to Mitigate CVE-2026-75852
Immediate Actions Required
- Upgrade ArcadeDB to version 26.8.1 or later, which enforces SASL authentication on data commands.
- Restrict network access to TCP port 27017 so that only trusted application hosts can reach the MongoDB wire-protocol listener.
- Audit all databases on affected instances for unauthorized records, collections, or newly created databases.
- Rotate credentials and secrets that may have been exposed through unauthorized reads.
Patch Information
The issue is fixed in ArcadeDB 26.8.1. See the GitHub Security Advisory GHSA-fq9c-x968-g278 for release notes and remediation guidance from the maintainers.
Workarounds
- Disable the MongoDB wire-protocol plugin if MongoDB client compatibility is not required.
- Bind the MongoDB listener to localhost or an isolated management interface until the upgrade is applied.
- Enforce firewall rules or security group policies that block inbound traffic to port 27017 from untrusted networks.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
