THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-67343 (HIGH 8.8) — ArcadeDB versions before 26.7.2 fail to properly redact the cluster token in the GET /api/v1/server endpoint, allowing authenticated users to retrieve the arcadedb.ha.clusterToken value in cleartext. Attackers can use the leaked token with X-ArcadeDB-Cluster-Token and X-ArcadeDB-

[NVD] CVE-2026-67343 (HIGH 8.8) — ArcadeDB versions before 26.7.2 fail to properly redact the cluster token in the GET /api/v1/server endpoint, allowing authenticated users to retrieve the arcadedb.ha.clusterToken value in cleartext. Attackers can use the leaked token with X-ArcadeDB-Cluster-Token and X-ArcadeDB-

mednvdPublished 2026-08-01

CVE-2026-67343 CVSS: 8.8 HIGH Published: 2026-08-01T13:17:05.563

ArcadeDB versions before 26.7.2 fail to properly redact the cluster token in the GET /api/v1/server endpoint, allowing authenticated users to retrieve the arcadedb.ha.clusterToken value in cleartext. Attackers can use the leaked token with X-ArcadeDB-Cluster-Token and X-ArcadeDB-Forwarded-User headers to impersonate root and execute

Indicators of compromise

CVE-2026-67343cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-67343