CyberRota Analysis
AI-GeneratedArcadeDB versions prior to 26.7.2 are vulnerable due to improper redaction of the cluster token in the GET /api/v1/server endpoint, allowing authenticated users to access the arcadedb.ha.clusterToken in cleartext. This exposure enables attackers to impersonate root users, facilitating unauthorized administrative actions such as user creation, database manipulation, and server shutdown. Organizations using affected versions should prioritize patching to mitigate the risk of significant security breaches.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
ArcadeDB versions before 26.7.2 fail to properly redact the cluster token in the GET /api/v1/server endpoint, allowing authenticated users to retrieve the arcadedb.ha.clusterToken value in cleartext. Attackers can use the leaked token with X-ArcadeDB-Cluster-Token and X-ArcadeDB-Forwarded-User headers to impersonate root and execute administrative actions including user creation, database operations, and server shutdown.