A vulnerability in ArcadeDB allows authenticated users to access sensitive cluster tokens, leading to potential unauthorized information disclosure.

This vulnerability (CWE-200) allows an authenticated user to gain access to sensitive information. The flaw specifically involves the exposure of cluster tokens through the API server endpoint, which could be leveraged to gain further unauthorized access.

The CVSS score of 8.8 reflects a high level of risk, as the exposure of cluster tokens can lead to a complete compromise of the database cluster. Unauthorized actors could potentially read, modify, or delete sensitive data, leading to severe business disruption and loss of data confidentiality.

Immediate Action: Upgrade ArcadeDB to version 26.7.2 or later to mitigate the token disclosure risk.

Proactive Monitoring: Audit API access logs to identify any suspicious requests to the v1 server endpoint that might indicate an attempt to harvest sensitive tokens.

Compensating Controls: Implement strict API gateway controls and monitor for abnormal data retrieval patterns that deviate from expected application behavior.

Public Exploit Available: Unknown

Organizations utilizing ArcadeDB should prioritize the upgrade to version 26.7.2. Given the high severity of the potential information disclosure, ensuring that the API endpoints are secured and the patch is applied is critical to maintaining the integrity of the database environment.