Is CVE-2026-67343 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-67343 being exploited in the wild.

How severe is CVE-2026-67343?

High severity, with a CVSS score of 8.8, published 1 August 2026.

Which products and versions are affected?

ArcadeData ArcadeDB before 26.7.2.

Is there a fix for CVE-2026-67343?

A patch was published on 2026-07-09: Version 26.7.2 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-67343 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-67343?

Check whether you run ArcadeData ArcadeDB at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-67343: ArcadeDB cluster token disclosure in GET /api/v1/server

CVE-2026-67343 · Severity: high · CVSS 8.8 · Published 2026-08-01

ArcadeDB is a database platform used for storing and managing application data. Versions before 26.7.2 expose a sensitive authentication token through an API endpoint that should have been hidden, allowing any authenticated user to read the token in plain text. An attacker with basic user access can use this token to impersonate the administrative root account, gaining the ability to create users, delete databases, and shut down the server entirely.

Technologies: ArcadeData ArcadeDB. Vendors: ArcadeData.

Quick answers

Is CVE-2026-67343 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-67343 being exploited in the wild.
How severe is CVE-2026-67343?: High severity, with a CVSS score of 8.8, published 1 August 2026.
Which products and versions are affected?: ArcadeData ArcadeDB before 26.7.2.
Is there a fix for CVE-2026-67343?: A patch was published on 2026-07-09: Version 26.7.2 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-67343 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-67343?: Check whether you run ArcadeData ArcadeDB at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an information disclosure flaw (CWE-200) in the GET /api/v1/server endpoint. The root cause is that the exportSettings() function in GetServerHandler.java fails to apply the isHidden() predicate to all sensitive configuration keys; it masks only keys containing "password" by name, ignoring the arcadedb.ha.clusterToken which is explicitly flagged as hidden. A separate authentication bypass allows requests bearing X-ArcadeDB-Cluster-Token and X-ArcadeDB-Forwarded-User headers to bypass password checks in validateClusterForwardedAuth(), granting access as the specified user. Attack requires only authentication (no root privilege), network reachability to the API, and is triggered when an operator has explicitly configured HA_CLUSTER_TOKEN (auto-generated defaults are not affected). Exploitation yields full server compromise. Patched in version 26.7.2.

Affected products

ArcadeData ArcadeDB before 26.7.2

Timeline

2026-07-09: disclosed
2026-08-01: advisory
2026-07-09: patched: Version 26.7.2 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.