https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-09-29T18:09:54.287629+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/fkie_cve-2026-67357 fkie_cve-2026-67357 2026-09-29T18:09:54.792529+00:00

ArcadeDB versions before 26.7.3 contain an information disclosure vulnerability in the MCP get_server_settings tool that leaks the arcadedb.ha.clusterToken in cleartext. Attackers with MCP access can retrieve the cluster token and use it with X-ArcadeDB-Cluster-Token and X-ArcadeDB-Forwarded-User headers to impersonate root and achieve full server compromise.

 https://vulnerability.circl.lu/vuln/ghsa-7qj8-rw8h-hhxv GHSA-7qj8-rw8h-hhxv 2026-09-29T18:09:54.792662+00:00

ArcadeDB versions before 26.7.3 contain an information disclosure vulnerability in the MCP get_server_settings tool that leaks the arcadedb.ha.clusterToken in cleartext. Attackers with MCP access can retrieve the cluster token and use it with X-ArcadeDB-Cluster-Token and X-ArcadeDB-Forwarded-User headers to impersonate root and achieve full server compromise.