---
id: CVE-2026-75854
title: >-
  ArcadeDB versions before 26.8.1 contain a missing authentication vulnerability
  in the Redis wire-protocol plugin that allows unauthenticated attackers to
  read, write, and delete data
summary: >-
  ArcadeDB versions before 26.8.1 contain a missing authentication vulnerability
  in the Redis wire-protocol plugin that allows unauthenticated attackers to
  read, write, and delete data. Attackers can connect to the Redis port and
  execute a…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-306
vendor: ArcadeData
product: arcadedb
affected:
  - arcadedb < 26.8.1
published: '2026-08-18'
updated: '2026-10-08'
sourceUpdated: '2026-10-08T16:17:41.373'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-75854'
references:
  - url: >-
      https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-m46c-jh3x-xwrp
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/arcadedb-redis-wire-protocol-plugin-missing-authentication
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-m46c-jh3x-xwrp
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-08-18T14:17:56.551792Z'
epss: 0.00887
epssPercentile: 0.59102
ingestedAt: '2026-09-08T21:11:12.280Z'
---

## Overview

ArcadeDB versions before 26.8.1 contain a missing authentication vulnerability in the Redis wire-protocol plugin that allows unauthenticated attackers to read, write, and delete data. Attackers can connect to the Redis port and execute arbitrary commands against any database on the server without providing credentials, bypassing all security gates.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.