What happened
Published August 2, 2026 (CVSS 7.5/High). Any user granted MCP access to ArcadeDB — regardless of their configured database role — effectively obtains root-equivalent database privileges, including arbitrary server-side JavaScript execution, because authorization checks never actually evaluate the caller's identity over the MCP HTTP transport.
Why it matters
This collapses ArcadeDB's entire role-based access model for any AI agent or tool connected via MCP: an agent scoped to a low-privilege MCP user can instead perform full DDL/data mutation and arbitrary code execution inside the database, a critical escalation path in any agentic workflow that gives an LLM tool access to an ArcadeDB-backed knowledge base or vector store.
Attack vector
The MCP HTTP transport fails to bind the authenticated principal to the request context, causing the engine's permission-check layer to silently pass every authorization check as a no-op. A non-root but MCP-allowed user can perform arbitrary database writes, DDL/schema mutations, and execute arbitrary JavaScript via the SQL `DEFINE FUNCTION ... LANGUAGE js` mechanism.
Affected systems
ArcadeDB < 26.7.3 (MCP HTTP transport)
Mitigation
Upgrade to ArcadeDB 26.7.3 or later, which correctly binds the authenticated principal for permission enforcement in the MCP HTTP transport. See GHSA-6x73-v3rc-f57c.