What is CVE-2026-75852?
ArcadeDB versions before 26.8.1 do not enforce SASL authentication on data commands in the MongoDB wire-protocol plugin. This allows unauthenticated attackers to execute database commands (insert, find, update, delete) by connecting to port 27017 without credentials. Upgrading to version 26.8.1 or later is recommended.
Azərbaycanca: ArcadeDB-nin 26.8.1 versiyasından əvvəlki versiyalarında MongoDB wire-protocol plugin-də SASL autentifikasiyası tətbiq edilmir. Bu boşluq autentifikasiya olunmamış hücumçulara 27017 portu üzərindən verilənlər bazası əmrlərini (insert, find, update, delete) icra etməyə imkan verir. ArcadeDB-ni 26.8.1 və ya daha yuxarı versiyaya yeniləmək tövsiyə olunur.
Related CVEs
link basis: same weakness class CWE-306
FAQ2
How to protect against the authentication vulnerability in ArcadeDB's MongoDB wire-protocol plugin?
Upgrading to version 26.8.1 or later is recommended because ArcadeDB versions before 26.8.1 do not enforce SASL authentication.
What database commands can unauthenticated attackers execute via this vulnerability?
Attackers can execute database commands such as insert, find, update, and delete by connecting to port 27017 without credentials.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.