ArcadeDB Authentication Bypass in MCP HTTP Transport

ArcadeDB versions before 26.7.3 fail to bind the authenticated principal in the MCP HTTP transport, causing all engine permission checks to silently pass as no-ops. Non-root MCP-allowed users can perform arbitrary database writes, DDL, schema mutations, and execute arbitrary JavaScript code via the query tool.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

ArcadeDB versions before 26.7.3 contain a critical authentication flaw where the MCP HTTP transport layer fails to bind authenticated principals to requests, causing all permission checks to silently pass without validation. This means non-root users with MCP access can completely bypass authorization controls and gain unrestricted database access—performing arbitrary writes, executing DDL statements, modifying schemas, and running malicious JavaScript code. Any organization running vulnerable ArcadeDB instances in multi-tenant or restricted-access environments faces immediate risk of data corruption, exfiltration, and lateral movement through application logic execution.

Casky's 283 mapped skills leverage Claude's extended reasoning to detect the attack patterns associated with this vulnerability across MITRE ATT&CK TA0004 (Privilege Escalation) and TA0006 (Credential Access) techniques. Practitioners using Casky would identify suspicious indicators such as: unauthorized permission-check bypasses during authentication validation (CWE-306), schema modification attempts from low-privilege accounts that should have been rejected, JavaScript execution from query tools without proper principal binding, and anomalous database write operations originating from MCP-authenticated sessions. The platform's skill correlation would surface these permission-related gaps and credential mishandling patterns in real time, enabling defenders to spot exploitation before damage occurs.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-68578.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-68578

Casky has 283 skills that investigate the attack patterns behind CVE-2026-68578. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn