Critical severity · published Aug 18, 2026
CVE-2026-75854
ArcadeDB Redis Wire-Protocol Plugin Missing Authentication
9.8
CVSS
0.9%
EPSS
No
On KEV
Description
ArcadeDB versions before 26.8.1 contain a missing authentication vulnerability in the Redis wire-protocol plugin that allows unauthenticated attackers to read, write, and delete data. Attackers can connect to the Redis port and execute arbitrary commands against any database on the server without providing credentials, bypassing all security gates.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 59% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AR
arcadedb · ArcadeData
before 26.8.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-75854
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-75854
vendor-advisory
https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-m46c-jh3x-xwrp
third-party-advisory
https://www.vulncheck.com/advisories/arcadedb-redis-wire-protocol-plugin-missing-authentication
More from arcadedb
9.9
CVE-2026-75851
ArcadeDB before 26.8.1 Authentication Bypass via Async Command
9.9
CVE-2026-75843
ArcadeDB before 26.8.1 Privilege Escalation via gRPC Transaction
9.8
CVE-2026-75852
ArcadeDB MongoDB wire protocol authentication bypass cross-database
9.8
CVE-2026-67341
ArcadeDB before 26.7.2 Authorization Bypass via SQL DEFINE FUNCTION
9.8
CVE-2026-67342
ArcadeDB before 26.7.2 Authorization Bypass via Database Handlers