Description

ArcadeDB versions before 26.8.1 fail to enforce SASL authentication on data commands in the MongoDB wire-protocol plugin. Unauthenticated attackers can issue insert, find, update, delete, and create commands against any database by connecting to port 27017 without credentials.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-18T12:19:35.593Z",
  "pubdate": "2026-08-18T12:19:35.593Z",
  "executiveSummary": "ArcadeDB versions prior to 26.8.1 contain an authentication bypass vulnerability within the MongoDB wire-protocol plugin. The flaw stems from a failure to properly enforce SASL authentication mechanisms on incoming data commands.\nUnauthenticated remote attackers can connect directly to the service on port 27017 without supplying valid credentials and successfully issue privileged operations, including insert, find, update, delete, and create commands against any hosted database.\nThis vulnerability presents severe risks to data confidentiality, integrity, and availability, as unauthorized external entities can fully manipulate database contents without prior authentication.\nExploitation requires network accessibility to the vulnerable MongoDB wire-protocol port and does not require any specialized privileges or pre-existing credentials.\nOrganizations utilizing affected versions of ArcadeDB must apply vendor-supplied updates or restrict network access to the affected service to mitigate the exposure.",
  "technicalDetails": "The vulnerability resides in the MongoDB wire-protocol plugin implementation within ArcadeDB versions before 26.8.1.\nThe root cause of the issue is the complete omission or improper enforcement of Simple Authentication and Security Layer (SASL) authentication checks prior to processing core database interaction commands.\nThe vulnerable component is explicitly exposed via the MongoDB wire-protocol interface listening on port 27017.\nBecause the application layer logic fails to validate authentication states for commands arriving via this specific protocol handler, unauthenticated sessions are treated as implicitly trusted.\nThe attack flow proceeds as follows: 1) An attacker establishes a raw TCP socket connection to port 27017 hosting the ArcadeDB MongoDB wire-protocol plugin. 2) The attacker bypasses any standard SASL handshake requirement by immediately transmitting standard MongoDB wire-protocol opcodes or command documents. 3) The plugin parses and executes payloads such as insert, find, update, delete, and create commands without verifying identity or token validity. 4) The database processes these unauthorized requests against target databases, returning query results or confirming data modifications to the unauthenticated client.\nNetwork exposure is defined by the accessibility of port 27017, and the required privilege level is entirely unauthenticated, allowing any network-adjacent or remote entity with routing capabilities to interact with the database engine.\nPost-exploitation impact includes arbitrary data insertion, unauthorized data retrieval (exfiltration), data modification, database record deletion, and the creation of unauthorized database schemas or collections."
}