# CVE-2026-67357: CVE-2026-67357: An ArcadeDB Settings Tool Exposed Over MCP Returns the Cluster Token in Cleartext (CVSS 7.7)

> CVE-2026-67357 is a high-severity credential theft issue (CVSS 7.7) in ArcadeDB, a MCP server. Affected: ArcadeDB < 26.7.3. Fixed in 26.7.3.. Fixed in 26.7.3.

- **Canonical URL:** https://catalog.anomity.ai/vuln/cve-2026-67357
- **Aliases:** ti-095
- **Severity:** high
- **CVSS:** 7.7
- **Attack type:** Credential theft, Privilege escalation
- **Component:** ArcadeDB (MCP server)
- **Exploited in the wild:** no known exploitation
- **Published:** 2026-08-02
- **Last verified:** 2026-11-01
- **JSON:** https://catalog.anomity.ai/api/entries/vuln/cve-2026-67357

## Summary

ArcadeDB before 26.7.3 exposes a get_server_settings tool over MCP that returns arcadedb.ha.clusterToken in cleartext. That token is enough: presented in the X-ArcadeDB-Cluster-Token and X-ArcadeDB-Forwarded-User headers it impersonates root, so MCP read access converts directly into full server compromise. NVD published it on 2 August 2026 at CVSS 7.7 and it is fixed in 26.7.3. The bug is almost boring and that is the point - nobody wrote an exploit, they wrote a tool that returns settings and never filtered secrets out of the output. What changes with MCP is who the audience for that output is. A settings endpoint is normally read by an operator who already holds the credentials it echoes; the same endpoint exposed as an agent tool is read by whatever the agent is willing to be talked into, and the agent will happily relay the token into a summary, a log, or a message. Any read-only tool that returns configuration should be assumed to be a credential-disclosure surface until someone has checked its output field by field.

## Affected versions

| Affected | Fixed in |
| --- | --- |
| ArcadeDB < 26.7.3. Fixed in 26.7.3. | 26.7.3 |

## Am I affected by CVE-2026-67357?

You are affected if you run ArcadeDB < 26.7.3. Fixed in 26.7.3.. Versions 26.7.3 and later include the fix.

## How do I fix CVE-2026-67357?

Upgrade to 26.7.3 and rotate arcadedb.ha.clusterToken, in that order - the upgrade stops the disclosure but does nothing about a token already read, and this one is a root-equivalent credential, so leaving it in place leaves the compromise available. Then treat this as a question about your other MCP servers rather than about ArcadeDB, since the defect class is a settings or diagnostics tool that returns its configuration wholesale: enumerate the tools your servers actually expose, and for each one that reads configuration, state, or environment, check what a full response contains. Where you cannot audit a tool, do not expose it - dropping a get-settings tool from the exposed tool set costs an agent very little and removes the surface entirely.

## How do I find every machine running ArcadeDB?

Anomity inventories the AI agents, MCP servers, IDE extensions and skills on each developer device, so you can see which machines run ArcadeDB and which version, then enforce a policy on it.

## References

- advisory: https://www.vulncheck.com/advisories/arcadedb-information-disclosure-via-get-server-settings
- cve: https://nvd.nist.gov/vuln/detail/CVE-2026-67357

## Related vulnerabilities

- [CVE-2026-114612](https://catalog.anomity.ai/vuln/cve-2026-114612) — critical
- [tensorlake-npm-sdk-0-5-144-compromised-by-a-shai-hulud-chaindrop-worm](https://catalog.anomity.ai/vuln/tensorlake-npm-sdk-0-5-144-compromised-by-a-shai-hulud-chaindrop-worm) — critical
- [CVE-2026-104850](https://catalog.anomity.ai/vuln/cve-2026-104850) — high
- [CVE-2026-63127](https://catalog.anomity.ai/vuln/cve-2026-63127) — high
- [CVE-2026-59822](https://catalog.anomity.ai/vuln/cve-2026-59822) — critical
- [gen-digital-infostealers-callbackbeaver-amatera-remus-djinn-now-harvest](https://catalog.anomity.ai/vuln/gen-digital-infostealers-callbackbeaver-amatera-remus-djinn-now-harvest) — high

---

Source: Anomity Security Database (https://catalog.anomity.ai/vuln). Detect affected AI tools on developer devices: https://anomity.ai/?utm_source=catalog&utm_medium=vuln-md&utm_campaign=cve-2026-67357