CVE-2026-75852
CRITICAL
NVD
CVSS Score
9.8
Severity
CRITICAL
Published
Aug 18, 2026
Vendor
unknown
Description
ArcadeDB versions before 26.8.1 fail to enforce SASL authentication on data commands in the MongoDB wire-protocol plugin. Unauthenticated attackers can issue insert, find, update, delete, and create commands against any database by connecting to port 27017 without credentials.