ArcadeDB MCP Server Cluster Token Disclosure and Root Impersonation

Technical Analysis

The get_server_settings MCP tool returns configuration data including arcadedb.ha.clusterToken without redaction, exposing it to any agent or user with MCP tool access. An attacker who calls this tool can extract the token and replay it via the X-ArcadeDB-Cluster-Token and X-ArcadeDB-Forwarded-User HTTP headers, which the server trusts to authenticate inter-node cluster requests. By forging these headers with an arbitrary username such as root, the attacker escalates from ordinary MCP tool access to full administrative control of the ArcadeDB instance, effectively crossing the trust boundary between a low-privilege tool consumer and the database's highest-privilege identity. This is a classic sensitive-data-in-tool-output flaw compounded by weak header-based trust in the cluster authentication design.

Affected Systems

ArcadeDB; protocols: MCP

Detection Signatures

• MCP tool calls to get_server_settings followed by unusual HTTP requests bearing X-ArcadeDB-Cluster-Token and X-ArcadeDB-Forwarded-User headers
• Requests forging X-ArcadeDB-Forwarded-User as root or other privileged accounts from non-cluster source IPs
• Repeated or scripted invocation of MCP settings/introspection tools by low-privilege agents
• Cluster token values appearing in MCP tool response logs or agent transcripts

Remediation Steps

1. 1

   Upgrade ArcadeDB

   Update to ArcadeDB 26.7.3 or later, which addresses this information disclosure vulnerability.

2. 2

   Redact sensitive settings from MCP tool output

   Ensure get_server_settings and similar introspection tools never return secrets such as cluster tokens; apply output filtering/allowlisting for MCP tool responses.

3. 3

   Rotate cluster tokens

   Immediately rotate arcadedb.ha.clusterToken values on any deployment that exposed the MCP get_server_settings tool prior to patching.

4. 4

   Restrict MCP tool access

   Limit which identities/agents can invoke administrative or settings-related MCP tools; apply least-privilege scoping to MCP tool exposure.

5. 5

   Harden header-based cluster auth

   Do not rely solely on client-supplied headers for authentication; validate cluster tokens against mutual TLS or signed, non-forgeable credentials.