{
  "entry": {
    "kind": "vuln",
    "slug": "cve-2026-67357",
    "name": "CVE-2026-67357",
    "vendor": "ArcadeDB",
    "description": "ArcadeDB before 26.7.3 exposes a get_server_settings tool over MCP that returns arcadedb.ha.clusterToken in cleartext. That token is enough: presented in the X-ArcadeDB-Cluster-Token and X-ArcadeDB-Forwarded-User headers it impersonates root, so MCP read access converts directly into full server compromise. NVD published it on 2 August 2026 at CVSS 7.7 and it is fixed in 26.7.3. The bug is almost boring and that is the point - nobody wrote an exploit, they wrote a tool that returns settings and never filtered secrets out of the output. What changes with MCP is who the audience for that output is. A settings endpoint is normally read by an operator who already holds the credentials it echoes; the same endpoint exposed as an agent tool is read by whatever the agent is willing to be talked into, and the agent will happily relay the token into a summary, a log, or a message. Any read-only tool that returns configuration should be assumed to be a credential-disclosure surface until someone has checked its output field by field.",
    "website": "https://www.vulncheck.com/advisories/arcadedb-information-disclosure-via-get-server-settings",
    "repository": null,
    "documentationUrl": null,
    "license": null,
    "version": null,
    "trustLevel": "advisory",
    "capabilities": [],
    "packaging": null,
    "configFiles": null,
    "category": "mcp-server",
    "updatedAt": "2026-08-02",
    "risk": {
      "score": 77,
      "band": "high",
      "signals": [],
      "dangerousCombos": []
    },
    "dangerousCombos": [],
    "vuln": {
      "id": "CVE-2026-67357",
      "aliases": [
        "ti-095"
      ],
      "title": "CVE-2026-67357: An ArcadeDB Settings Tool Exposed Over MCP Returns the Cluster Token in Cleartext (CVSS 7.7)",
      "summary": "ArcadeDB before 26.7.3 exposes a get_server_settings tool over MCP that returns arcadedb.ha.clusterToken in cleartext. That token is enough: presented in the X-ArcadeDB-Cluster-Token and X-ArcadeDB-Forwarded-User headers it impersonates root, so MCP read access converts directly into full server compromise. NVD published it on 2 August 2026 at CVSS 7.7 and it is fixed in 26.7.3. The bug is almost boring and that is the point - nobody wrote an exploit, they wrote a tool that returns settings and never filtered secrets out of the output. What changes with MCP is who the audience for that output is. A settings endpoint is normally read by an operator who already holds the credentials it echoes; the same endpoint exposed as an agent tool is read by whatever the agent is willing to be talked into, and the agent will happily relay the token into a summary, a log, or a message. Any read-only tool that returns configuration should be assumed to be a credential-disclosure surface until someone has checked its output field by field.",
      "severity": "high",
      "cvss": {
        "score": 7.7,
        "vector": null,
        "version": null
      },
      "cwe": [],
      "attackType": [
        "Credential theft",
        "Privilege escalation"
      ],
      "componentType": "mcp-server",
      "component": {
        "name": "ArcadeDB",
        "vendor": null,
        "package": null,
        "ecosystem": null,
        "catalogSlug": null
      },
      "affected": [
        {
          "range": "ArcadeDB < 26.7.3. Fixed in 26.7.3.",
          "fixed": "26.7.3"
        }
      ],
      "exploited": false,
      "exploitPublic": false,
      "publishedAt": "2026-08-02",
      "modifiedAt": "2026-08-02",
      "lastVerified": "2026-11-01",
      "references": [
        {
          "type": "advisory",
          "url": "https://www.vulncheck.com/advisories/arcadedb-information-disclosure-via-get-server-settings"
        },
        {
          "type": "cve",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67357"
        }
      ],
      "mitigation": "Upgrade to 26.7.3 and rotate arcadedb.ha.clusterToken, in that order - the upgrade stops the disclosure but does nothing about a token already read, and this one is a root-equivalent credential, so leaving it in place leaves the compromise available. Then treat this as a question about your other MCP servers rather than about ArcadeDB, since the defect class is a settings or diagnostics tool that returns its configuration wholesale: enumerate the tools your servers actually expose, and for each one that reads configuration, state, or environment, check what a full response contains. Where you cannot audit a tool, do not expose it - dropping a get-settings tool from the exposed tool set costs an agent very little and removes the surface entirely.",
      "detectedByAnomity": true
    }
  }
}