by Kastro
Paper/Archive/CVE-2026-75854

CVE-2026-75854

ArcadeData arcadedb — ArcadeDB Redis Wire-Protocol Plugin Missing Authentication

EPSS 0.9%public exploitCVSS 9.8
critical.is priorityof 100
51
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 59.2.592 × 2011.8Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

ArcadeDB versions before 26.8.1 contain a missing authentication vulnerability in the Redis wire-protocol plugin that allows unauthenticated attackers to read, write, and delete data. Attackers can connect to the Redis port and execute arbitrary commands against any database on the server without providing credentials, bypassing all security gates.

Affected

ProductAffectedFixed inSource
arcadedb< 26.8.126.8.1CNA

Scores by source

VulnCheck (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
VulnCheck (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploitgithub.com/ArcadeData/arcadedb/security/advisories/GHSA-m46c-jh3x-xwrpwriteupvulncheck.com/advisories/arcadedb-redis-wire-protocol-plugin-missing-authentication