ArcadeDB Cluster Token Disclosure via API

Overview

ArcadeDB, the open-source multi-model database supporting document, graph, key-value, and time-series workloads, contains a high-severity information disclosure vulnerability in its HTTP API layer. In all versions prior to 26.7.2, the GET /api/v1/server endpoint returns the internal cluster coordination token (arcadedb.ha.clusterToken) in plaintext within its JSON response. This token, originally intended solely for inter-node communication in high-availability deployments, is never supposed to be surfaced to API consumers.

The vulnerability is straightforward but its consequences are not: any authenticated user — regardless of their privilege level — can retrieve this token and then use it in conjunction with two undocumented internal HTTP headers (X-ArcadeDB-Cluster-Token and X-ArcadeDB-Forwarded-User) to impersonate the root account on any node in the cluster. From that position an attacker can perform the full range of administrative operations: creating or dropping databases, managing user accounts, and issuing a server shutdown command.

The affected surface is any ArcadeDB deployment with the HTTP server enabled and at least one non-root authenticated account — which describes virtually every multi-user installation. Organizations running ArcadeDB in shared or SaaS-like configurations where database credentials are distributed to application services or end users are at particular risk.

Technical Analysis

The root cause is a missing redaction step in the server status serialization logic. When the /api/v1/server endpoint assembles its diagnostic JSON payload, it iterates over the server’s configuration properties and writes them to the response without filtering sensitive keys. The arcadedb.ha.clusterToken property, which holds the shared secret used to authenticate inter-node RPC calls, is included verbatim.

A simplified representation of the vulnerable serialization pattern looks like this:

// VULNERABLE — no redaction of sensitive configuration keys
@GET
@Path("/server")
@Produces(MediaType.APPLICATION_JSON)
public Response getServerInfo(@Context HttpHeaders headers) {
    final JsonObject response = new JsonObject();
    final JsonObject config = new JsonObject();

    // Iterates all configuration entries, including secrets
    for (final Map.Entry<String, Object> entry : server.getConfiguration().getProperties().entrySet()) {
        config.put(entry.getKey(), entry.getValue().toString());
    }

    response.put("configuration", config);
    response.put("version", Constants.getRawVersion());
    // ... additional diagnostic fields ...

    return Response.ok(response.encode()).build();
}

The leaked token value can then be supplied in two custom headers that ArcadeDB’s HA subsystem honors for forwarded requests between cluster nodes:

GET /api/v1/server
Authorization: Basic <any_valid_user_credentials>

HTTP/1.1 200 OK
Content-Type: application/json

{
  "configuration": {
    "arcadedb.ha.clusterToken": "s3cr3tClusterTokenValue",
    ...
  }
}

Once the attacker holds the cluster token, they replay it as follows to impersonate root:

POST /api/v1/server
X-ArcadeDB-Cluster-Token: s3cr3tClusterTokenValue
X-ArcadeDB-Forwarded-User: root
Content-Type: application/json

{
  "command": "create database pwned"
}

The server’s HA request handler validates only that the X-ArcadeDB-Cluster-Token header matches the stored token. If it does, the X-ArcadeDB-Forwarded-User value is accepted as the authenticated identity without any independent credential check — a classic confused-deputy pattern. Because the cluster token is a long-lived static secret (it does not rotate automatically), a single disclosure event grants persistent root-equivalent access until an administrator manually regenerates the token.

The CWE classifications that apply here are CWE-312 (Cleartext Storage of Sensitive Information) for the configuration serialization path and CWE-862 (Missing Authorization) for the header-based identity bypass. The CVSS 3.1 vector is consistent with network-exploitable, low-complexity, low-privilege-required, high-impact across confidentiality, integrity, and availability — aligning with the published 8.8 score.

Impact

An attacker with any valid ArcadeDB credential can escalate to root and achieve the following outcomes:

• Full database control: create, drop, or corrupt any database hosted on the cluster
• User account manipulation: add new administrative accounts or modify existing credentials to establish persistent backdoors
• Data exfiltration: query any database, including those the original low-privilege account had no access to
• Denial of service: issue a server shutdown command to bring down the entire ArcadeDB instance or individual cluster nodes
• Lateral movement within the cluster: because the cluster token is shared across all nodes, compromise of a single node’s API response extends the attacker’s reach to every peer in the HA ring

In cloud or containerized environments where ArcadeDB is exposed to internal service meshes, this vulnerability allows a compromised application-tier service to pivot into the database tier with full administrative rights, bypassing any role-based access controls configured at the database level.

How to Fix It

The immediate remediation is to upgrade to ArcadeDB 26.7.2 or later. The patched release introduces an explicit denylist of sensitive configuration keys that are stripped from the /api/v1/server response before serialization.

The corrected server serialization pattern filters known secret properties:

// FIXED — sensitive keys are redacted before inclusion in the API response
private static final Set<String> REDACTED_KEYS = Set.of(
    "arcadedb.ha.clusterToken",
    "arcadedb.server.defaultPassword"
    // extend as additional secrets are introduced
);

@GET
@Path("/server")
@Produces(MediaType.APPLICATION_JSON)
public Response getServerInfo(@Context HttpHeaders headers) {
    final JsonObject response = new JsonObject();
    final JsonObject config = new JsonObject();

    for (final Map.Entry<String, Object> entry : server.getConfiguration().getProperties().entrySet()) {
        if (REDACTED_KEYS.contains(entry.getKey())) {
            config.put(entry.getKey(), "********");  // redact, do not omit — omission can hint at key existence
        } else {
            config.put(entry.getKey(), entry.getValue().toString());
        }
    }

    response.put("configuration", config);
    response.put("version", Constants.getRawVersion());

    return Response.ok(response.encode()).build();
}

For operators who cannot upgrade immediately:

1. Restrict network access to the HTTP API (default port 2480) to trusted hosts only using firewall rules or a reverse proxy with IP allowlisting.
2. Audit current cluster token usage and regenerate the token if the endpoint has been accessible to untrusted users.
3. Apply the principle of least privilege: do not distribute database credentials to accounts that do not require API-level server access.

Upgrade commands:

# If running via the official release archive, replace the existing installation:
curl -LO https://github.com/ArcadeData/arcadedb/releases/download/26.7.2/arcadedb-26.7.2.zip
unzip arcadedb-26.7.2.zip

# Maven dependency update:
# <dependency>
#   <groupId>com.arcadedb</groupId>
#   <artifactId>arcadedb-server</artifactId>
#   <version>26.7.2</version>
# </dependency>

Our Take

This vulnerability is a textbook example of the “diagnostics endpoint as an information leak” pattern — a class that we see repeatedly in server software that exposes rich introspection APIs for operational convenience. The underlying mistake is treating all configuration properties as equivalent and serializing the entire map without considering which values are security-sensitive. The HA cluster token exists in the same configuration store as harmless tuning parameters like buffer sizes or thread counts, and without an explicit review step, it flows out with everything else.

What makes this particularly instructive is the second-order consequence: the leaked token doesn’t just expose a secret, it unlocks a completely separate authentication bypass in the cluster forwarding logic. This is a defense-in-depth failure. If the cluster token had been properly scoped — validated only on connections arriving from known peer IP addresses rather than accepted from any client — the impact of its disclosure would have been contained. Neither protection was sufficient on its own, but the absence of both in combination produced a critical privilege escalation path from the lowest-privilege authenticated user to root.

Enterprises deploying ArcadeDB in production should treat any multi-model or graph database’s administrative HTTP interface with the same scrutiny applied to a privileged management console — it should not be reachable from the same network segment as application-tier services unless absolutely necessary.

Detection with SAST

SAST analysis catches this vulnerability class under CWE-312 and CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). Offensive360’s analysis engine flags the following patterns during code review:

• Unrestricted configuration map serialization: any code path that iterates a full server or application configuration object and writes it to an HTTP response without an explicit allowlist or denylist.
• Credential-adjacent property names in response builders: property keys matching patterns like *token*, *secret*, *password*, *key*, or *credential* appearing in JSON serialization paths that terminate in an API response object.
• Trust elevation via HTTP header without secondary authentication: code that reads a user identity from a request header and grants elevated permissions based solely on a shared-secret header value, without verifying the identity through the standard authentication subsystem.

Rules in this category typically map to OWASP API Security Top 10: API3 — Excessive Data Exposure in addition to the CWE references above. In DAST, the endpoint is flagged when a response from an authenticated low-privilege session contains values that pattern-match against the known sensitive property namespace and those values are subsequently accepted by a privileged endpoint.

References

• https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-46hj-24h4-j8gf
• https://www.vulncheck.com/advisories/arcadedb-before-cluster-token-disclosure-via-get-api-v1-server