Is CVE-2026-75852 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-75852?

CVE-2026-75852 has a CVSS v3 severity of CRITICAL (9.8).

Back

CVE-2026-75852

Description

ArcadeDB versions before 26.8.1 fail to enforce SASL authentication on data commands in the MongoDB wire-protocol plugin. Unauthenticated attackers can issue insert, find, update, delete, and create commands against any database by connecting to port 27017 without credentials.