ArcadeDB versions before 26.8.1 do not enforce SASL authentication on data commands in the MongoDB wire‑protocol plugin. An attacker who can reach the database server on port 27017 can issue insert, find, update, delete, and create commands without credentials, effectively gaining full control over any database. This bypass allows arbitrary data modification and potential data loss or corruption, and could be used as a foothold for further attacks on systems connected to the database.

The vulnerability affects ArcadeData ArcadeDB installations running any version earlier than 26.8.1. The issue exists only when the MongoDB wire‑protocol plugin is enabled, allowing access through the standard MongoDB port 27017.

The CVSS base score of 9.3 indicates a critical severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote, via the database’s network interface, and requires no credential or special configuration. An unauthenticated attacker can immediately exploit the flaw by connecting to port 27017 and issuing any supported command, making the risk very high for exposed deployments.