Description

ArcadeDB versions 26.4.2 through 26.7.3 contain an authorization bypass vulnerability in the set_server_setting MCP server-level tool. SetServerSettingTool.execute() gates only on the global allowAdmin flag and never checks the caller's role, so in an MCP deployment with allowAdmin=true and a non-root allowedUsers set, any authenticated read-only user can invoke set_server_setting to modify server GlobalConfiguration, enabling configuration tampering or denial of service. The issue is fixed in 26.8.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-08-18T12:19:35.040Z",
  "pubdate": "2026-08-18T12:19:35.040Z",
  "executiveSummary": "ArcadeDB versions 26.4.2 through 26.7.3 suffer from an authorization bypass vulnerability located within the set_server_setting MCP server-level tool. The flaw allows authenticated, read-only users to bypass intended role-based access restrictions and invoke the SetServerSettingTool.execute() function, leading to unauthorized modification of server configurations.\nThe primary impact of this vulnerability includes configuration tampering and potential denial of service (DoS) conditions against the affected database server. The vulnerability stems from improper access control checks that rely solely on the global allowAdmin flag without validating the caller's specific administrative role.\nExploitation requires an attacker to be authenticated within an MCP deployment configured with allowAdmin=true and a non-root allowedUsers set. Under these conditions, a low-privileged or read-only user can leverage the flaw to execute administrative commands and alter critical server GlobalConfiguration parameters without possessing the necessary administrative privileges.",
  "technicalDetails": "The vulnerability resides in the set_server_setting MCP server-level tool of ArcadeDB, specifically within the SetServerSettingTool.execute() method. The root cause of the issue is an incomplete authorization check implementation. Rather than performing a comprehensive validation of the caller's assigned role or privileges, the execution logic gates access exclusively on the global allowAdmin flag.\nIn an MCP deployment where allowAdmin is set to true and a non-root allowedUsers configuration is defined, the system fails to verify whether the authenticated caller possesses administrative privileges. Consequently, any authenticated user—including those restricted to read-only roles—can successfully invoke the set_server_setting tool.\nThe attack flow proceeds as follows: First, an attacker authenticates to the ArcadeDB MCP deployment as a low-privileged or read-only user. Next, the attacker formulates an API call targeting the set_server_setting tool. Because the execution handler only validates the global allowAdmin parameter and neglects to enforce role-based access control, the request passes the authorization gate. Finally, the SetServerSettingTool.execute() method processes the payload and applies arbitrary modifications to the server GlobalConfiguration.\nThe post-exploitation impact allows malicious actors to alter critical server settings, introducing misconfigurations that can disrupt database operations, corrupt server state, or induce a denial of service (DoS). The affected versions span from 26.4.2 through 26.7.3, and the issue is fully resolved in version 26.8.1."
}