CVE-2026-75854

ArcadeDB versions before 26.8.1 contain a missing authentication vulnerability in the Redis wire-protocol plugin that allows unauthenticated attackers to read, write, and delete data. Attackers can connect to the Redis port and execute arbitrary commands against any database on the server without providing credentials, bypassing all security gates.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-m46c-jh3x-xwrp
https://www.vulncheck.com/advisories/arcadedb-redis-wire-protocol-plugin-missing-authentication
https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-m46c-jh3x-xwrp

Configurations

No configuration.

History

22 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) Las versiones de ArcadeDB anteriores a la 26.8.1 contienen una vulnerabilidad de autenticación faltante en el plugin del protocolo de cable de Redis que permite a atacantes no autenticados leer, escribir y eliminar datos. Los atacantes pueden conectarse al puerto de Redis y ejecutar comandos arbitrarios contra cualquier base de datos en el servidor sin proporcionar credenciales, eludiendo todas las puertas de seguridad.

Information

Published : 2026-08-18 12:19

Updated : 2026-10-22 22:10

NVD link : CVE-2026-75854

Mitre link : CVE-2026-75854

CVE.ORG link : CVE-2026-75854

JSON object : View

Products Affected

No product.

CWE

CWE-306

Missing Authentication for Critical Function

{"id": "CVE-2026-75854", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-75854", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-18T14:17:56.551792Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "ArcadeData", "product": "arcadedb", "versions": [{"status": "affected", "version": "0", "lessThan": "26.8.1", "versionType": "semver"}, {"status": "unaffected", "version": "26.8.1", "versionType": "semver"}], "packageURL": "pkg:maven/com.arcadedb/arcadedb-redisw", "defaultStatus": "unaffected"}]}], "published": "2026-08-18T12:19:35.860", "references": [{"url": "https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-m46c-jh3x-xwrp", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/arcadedb-redis-wire-protocol-plugin-missing-authentication", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-m46c-jh3x-xwrp", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-306"}]}], "descriptions": [{"lang": "en", "value": "ArcadeDB versions before 26.8.1 contain a missing authentication vulnerability in the Redis wire-protocol plugin that allows unauthenticated attackers to read, write, and delete data. Attackers can connect to the Redis port and execute arbitrary commands against any database on the server without providing credentials, bypassing all security gates."}, {"lang": "es", "value": "Las versiones de ArcadeDB anteriores a la 26.8.1 contienen una vulnerabilidad de autenticaci\u00f3n faltante en el plugin del protocolo de cable de Redis que permite a atacantes no autenticados leer, escribir y eliminar datos. Los atacantes pueden conectarse al puerto de Redis y ejecutar comandos arbitrarios contra cualquier base de datos en el servidor sin proporcionar credenciales, eludiendo todas las puertas de seguridad."}], "lastModified": "2026-10-22T22:10:00.250", "sourceIdentifier": "disclosure@vulncheck.com"}