Description

ArcadeDB versions before 26.8.1 contain a missing authentication vulnerability in the Redis wire-protocol plugin that allows unauthenticated attackers to read, write, and delete data. Attackers can connect to the Redis port and execute arbitrary commands against any database on the server without providing credentials, bypassing all security gates.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-18T12:19:35.860Z",
  "pubdate": "2026-08-18T12:19:35.860Z",
  "executiveSummary": "ArcadeDB versions prior to 26.8.1 suffer from a critical missing authentication vulnerability residing within the Redis wire-protocol plugin.\nThis flaw enables unauthenticated remote threat actors to completely bypass all authentication gates and security controls enforced by the application.\nConsequently, attackers gain the ability to execute arbitrary commands directly against any hosted database on the target server, leading to unauthorized data read, write, and deletion operations.\nThe vulnerability exposes database instances to severe confidentiality, integrity, and availability risks if the Redis port is reachable over the network.\nNo complex exploitation requirements or prior credentials are needed; attackers merely establish a raw network connection to the designated Redis port and issue commands directly.\nGiven the severity of unauthorized data manipulation and administrative-level command execution, immediate remediation is required to secure vulnerable server deployments.",
  "technicalDetails": "The root cause of the vulnerability stems from the improper implementation of access controls and authentication mechanisms within the Redis wire-protocol plugin utilized by ArcadeDB.\nWhen clients initiate a connection to the Redis interface exposed by the database server, the component fails to validate credentials or enforce session authentication before processing incoming protocol commands.\nThe vulnerable component is explicitly the Redis wire-protocol plugin handling network traffic on the designated Redis port of the database server.\nAffected software versions include all ArcadeDB releases preceding version 26.8.1.\nThe exploitation method requires zero authentication prerequisites or prior privilege levels, operating entirely over network exposure where the Redis port is accessible.\nThe step-by-step attack flow proceeds as follows: First, the unauthenticated attacker discovers or targets the open Redis port associated with the ArcadeDB instance.\nSecond, the attacker establishes a standard network socket connection to the service without supplying any authentication tokens, passwords, or valid user identifiers.\nThird, because the Redis wire-protocol plugin lacks the necessary security gating, the server accepts the incoming connection and immediately begins parsing incoming command payloads.\nFourth, the attacker issues arbitrary Redis or database-mapped commands over the wire-protocol session.\nFinally, the ArcadeDB server executes these commands with the full privileges of the database process, allowing the payload to read sensitive records, modify existing data structures, or drop databases entirely.\nThe post-exploitation impact includes complete compromise of data stored within any database hosted on the server, unauthorized data exfiltration, persistent data alteration, and potential denial of service through destructive deletion commands."
}