CyberRota Analysis
AI-GeneratedArcadeDB versions 26.4.2 through 26.7.3 are vulnerable to an authorization bypass in the set_server_setting MCP server-level tool, allowing authenticated read-only users to modify server GlobalConfiguration if the allowAdmin flag is set to true. This flaw can lead to configuration tampering or denial of service. Organizations using affected versions should prioritize upgrading to version 26.8.1 to mitigate potential security risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
ArcadeDB versions 26.4.2 through 26.7.3 contain an authorization bypass vulnerability in the set_server_setting MCP server-level tool. SetServerSettingTool.execute() gates only on the global allowAdmin flag and never checks the caller's role, so in an MCP deployment with allowAdmin=true and a non-root allowedUsers set, any authenticated read-only user can invoke set_server_setting to modify server GlobalConfiguration, enabling configuration tampering or denial of service. The issue is fixed in 26.8.1.