CVE-2026-75854CWE-306

CVE-2026-75854

Critical · published August 18, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
58.9
In the wild
Unconfirmed
What it is

ArcadeDB versions before 26.8.1 contain a missing authentication vulnerability in the Redis wire-protocol plugin that allows unauthenticated attackers to read, write, and delete data. Attackers can connect to the Redis port and execute arbitrary commands against any database on the server without providing credentials, bypassing all security gates.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
9.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00887 · 58.9th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2026-08-18T16:19Z
References (3)
https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-m46c-jh3x-xwrp · 134c704f-9b21-4f2e-91b3-4a467353bcc0https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-m46c-jh3x-xwrp · [email protected]https://www.vulncheck.com/advisories/arcadedb-redis-wire-protocol-plugin-missing-authentication · [email protected]
EPSS history
Timeline
  • 18 AUG 11:19Z
    ArcadeDB Redis Wire-Protocol Plugin Missing Authentication
    cvelistv5