CVE-2026-75854: ArcadeDB Auth Bypass Vulnerability

CVE-2026-75854 Overview

ArcadeDB versions before 26.8.1 contain a missing authentication vulnerability [CWE-306] in the Redis wire-protocol plugin. Unauthenticated attackers can connect to the exposed Redis port and execute arbitrary commands against any database on the server. The plugin bypasses all security gates, letting remote adversaries read, write, and delete data without providing credentials. The flaw carries a CVSS 4.0 base score of 9.3 and affects the confidentiality, integrity, and availability of every database managed by the instance.

Critical Impact
Remote, unauthenticated attackers can fully compromise ArcadeDB data through the Redis wire-protocol port, bypassing authentication and authorization controls.

Affected Products

ArcadeDB versions prior to 26.8.1
ArcadeDB deployments with the Redis wire-protocol plugin enabled
Any database hosted on an affected ArcadeDB server instance

Discovery Timeline

2026-08-18 - CVE-2026-75854 published to NVD
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-75854

Vulnerability Analysis

ArcadeDB ships with a Redis wire-protocol plugin that lets Redis clients interact with ArcadeDB databases using the Redis serialization protocol (RESP). In vulnerable releases the plugin listens on the network without enforcing the authentication and authorization checks used by the primary ArcadeDB APIs.

Any client that reaches the Redis port can issue commands against any database on the server. Commands are dispatched directly to the storage layer, so attackers can read arbitrary records, mutate documents, and delete data. The plugin also exposes cross-database access, meaning a single unauthenticated session can pivot across every database the server hosts.

The flaw is remotely exploitable over the network, requires no user interaction, and needs no privileges. Exploitation leaves few application-layer traces because the requests never pass through the HTTP or Studio interfaces where audit and access controls are applied.

Root Cause

The root cause is a missing authentication check on a critical network-facing function, classified as [CWE-306]. The Redis plugin instantiates a listener that accepts RESP commands and forwards them to internal database handlers without invoking the credential validation, role checks, or database-scoped ACLs enforced elsewhere in ArcadeDB.

Attack Vector

The attack vector is network-based. An attacker who can reach the Redis wire-protocol port opens a TCP connection, speaks RESP, and issues read, write, or delete commands against a target database. No handshake, credential, or session token is required. Because the plugin trusts every connecting client, an internet-exposed instance is compromised on first packet. See the GitHub Security Advisory GHSA-m46c-jh3x-xwrp and the VulnCheck Advisory on ArcadeDB for protocol-level details.

Detection Methods for CVE-2026-75854

Indicators of Compromise

Inbound TCP connections to the ArcadeDB Redis wire-protocol listener from unexpected or external source addresses.
RESP command traffic to ArcadeDB hosts that does not correlate with an authenticated application workload.
Unexplained record creation, mutation, or deletion events across multiple databases on the same server.
ArcadeDB process logs showing Redis plugin activity outside normal maintenance windows.

Detection Strategies

Inventory ArcadeDB deployments and identify instances with the Redis wire-protocol plugin enabled and reachable from untrusted networks.
Alert on any inbound session to the Redis plugin port from IP ranges outside the sanctioned application tier.
Correlate database write and delete operations with authenticated HTTP or Studio activity to surface RESP-driven changes with no matching front-end session.

Monitoring Recommendations

Capture network flow logs for the ArcadeDB Redis port and retain them for retrospective hunts.
Baseline the volume and source of RESP commands per instance and alert on deviations.
Forward ArcadeDB server logs to a central analytics platform to correlate plugin activity with data-modification events.

How to Mitigate CVE-2026-75854

Immediate Actions Required

Upgrade ArcadeDB to version 26.8.1 or later on every affected instance.
Restrict network access to the Redis wire-protocol port using host firewalls, security groups, or network policies until patching is complete.
Audit database contents for unauthorized reads, writes, or deletions across all hosted databases.
Rotate any secrets, tokens, or application credentials stored inside ArcadeDB databases that may have been exposed.

Patch Information

ArcadeDB 26.8.1 addresses the missing authentication in the Redis wire-protocol plugin. Upgrade guidance and fix details are documented in the GitHub Security Advisory GHSA-m46c-jh3x-xwrp. Confirm the running version after upgrade and validate that the plugin now enforces credential checks.

Workarounds

Disable the Redis wire-protocol plugin in ArcadeDB configuration if it is not required by production workloads.
Bind the Redis plugin listener to 127.0.0.1 or an internal management interface so it is not reachable from untrusted networks.
Enforce network segmentation so only sanctioned application hosts can reach the ArcadeDB Redis port.
Place ArcadeDB behind an authenticated proxy or service mesh that terminates client connections and blocks unauthenticated RESP traffic.

bash

# Configuration example: block external access to the ArcadeDB Redis port
# Replace 6379 with the Redis wire-protocol port configured for your deployment
iptables -A INPUT -p tcp --dport 6379 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 6379 -j DROP