ArcadeDB
Multi-Model database with built-in MCP server for SQL, Cypher, Gremlin, and GraphQL.
26.3.1version the registry lists (1 published)
2reported issues
Nolisted version affected
Update first. Issues have been reported, but none is flagged on the version the registry lists. That version can trail the package's newest release, so check you run one past the issues below.
Registry name io.github.ArcadeData/arcadedb
· Source code
Reported issues
Each issue is counted once, with its other IDs listed under it. "Listed version" means the version the registry lists: "Not flagged" means OSV doesn't mark it as affected, and "Not checked" means the source gives no version we can compare.
| Issue | Severity | Listed version | Reported |
|---|---|---|---|
| CVE-2026-75845ArcadeDB versions 26.4.2 through 26.7.3 contain an authorization bypass vulnerability in the set_server_setting MCP server-level tool. SetServerSettingTool.execute() gates only on the global allowAdmin flag and never checks the caller's role, so in … | medium | Not checked | Aug 18, 2026 |
| CVE-2026-67357ArcadeDB versions before 26.7.3 contain an information disclosure vulnerability in the MCP get_server_settings tool that leaks the arcadedb.ha.clusterToken in cleartext. Attackers with MCP access can retrieve the cluster token and use it with X-Arca… | high | Not checked | Aug 2, 2026 |
Versions in the registry
26.3.1 (listed)