External risk intelligence

ArcadeDB MongoDB Plugin Authentication Bypass

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-75852

The vulnerability affects a database wire-protocol plugin that listens on port 27017, a common default port for MongoDB-compatible services. While databases are often placed behind internal networks, they are frequently exposed to application tiers or external interfaces, making network-reachable deployments a common and expected configuration for this type of service.

Missing Authentication

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in ArcadeDB's MongoDB wire-protocol plugin, allowing unauthenticated attackers to execute commands like insert, find, update, delete, and create on any database by connecting to the default MongoDB port. This bypasses existing authentication mechanisms, posing a significant risk to data integrity and availability across affected systems.

Authentication bypassed for database commands.
Data access and modification are possible without credentials.
Confirm if ArcadeDB's MongoDB plugin is in use.

Attack Path

How an attacker could exploit the issue

Attackers can bypass authentication on ArcadeDB's MongoDB wire-protocol plugin to perform unauthorized data operations. By connecting to the default MongoDB port without credentials, an attacker can issue commands to insert, find, update, delete, or create data in any database. This bypass allows for broad data manipulation and unauthorized access.

Unauthenticated network access required.
Insert, find, update, delete, create commands triggered.
Risk of unauthorized data access and modification.

Live Threat

Current exploitation, exposure, and threat context

Unauthenticated attackers could interact with any database by connecting to port 27017. This could allow them to insert, find, update, delete, or create data without needing credentials, when the MongoDB wire-protocol plugin is enabled and exposed.

Database commands and data.
Connecting to the exposed port.
Unauthorized data modification or access.

Operational Fix

Recommended remediation, mitigation, and detection steps

The ArcadeDB MongoDB wire-protocol plugin's failure to enforce SASL authentication on data commands presents a critical risk, allowing unauthenticated attackers to perform database operations. Teams responsible for database administration, application infrastructure, and network security should collaboratively address this. The immediate priority is to identify all instances of ArcadeDB using the affected plugin, ascertain their network exposure and business criticality, and then plan remediation.

Database and platform teams own remediation.
Verify SASL authentication is enforced.
Plan and execute mitigation or patching.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is ArcadeDB and why does it have a MongoDB plugin?

ArcadeDB is a multi-model database management system that supports various data formats, including graph and document models. To increase its flexibility and allow developers to use existing tools designed for MongoDB, it includes a wire-protocol plugin that mimics MongoDB's communication language. This allows applications built for MongoDB to interact with an ArcadeDB backend seamlessly.

What does CWE-306 mean for CVE-2026-75852?

CWE-306 refers to a Missing Authentication for Critical Function weakness. In the context of this CVE, it means the software performs sensitive data operations—like creating, reading, or deleting records—without verifying the user's identity first. Because the MongoDB plugin fails to enforce SASL authentication, the system effectively trusts any connection request it receives on the affected port.

When does this vulnerability trigger?

The vulnerability is triggered when an attacker connects to the specific port (27017) used by the MongoDB wire-protocol plugin. Because the plugin does not require credentials, simply initiating a connection is sufficient to start issuing unauthorized database commands. The bug does not trigger if the plugin is disabled or if the network service is not listening on that specific port.

Do I need to worry if my database is internal?

Halo Surface Signal notes that while databases are often placed on internal networks, they are frequently exposed to application tiers or other services. If your ArcadeDB instance is reachable over the network, even within an internal environment, attackers who have gained a foothold elsewhere in your infrastructure could reach the database. Any network-reachable deployment should be treated with caution.

How do I start addressing this issue?

The first step is to verify if your ArcadeDB installation has the MongoDB wire-protocol plugin enabled. If it is in use, check your software version against the 26.8.1 release, as earlier versions contain this defect. Prioritize isolating these instances from network access while you coordinate with your infrastructure team to apply the necessary updates or enforce proper authentication controls.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.