ArcadeDB MCP Server Missing Role Check in set_server_setting Tool

Technical Analysis

The vulnerability lies in SetServerSettingTool.execute(), which is exposed as an MCP tool endpoint and gates execution solely on a server-wide allowAdmin boolean, ignoring the individual caller's assigned role from the allowedUsers configuration. In deployments where allowAdmin=true but allowedUsers restricts most accounts to read-only access, any authenticated agent or user session invoking this tool through the MCP interface can escalate to modifying GlobalConfiguration values. This crosses the trust boundary between the MCP protocol layer (which authenticates the caller) and the application authorization layer (which should but fails to re-check role before executing privileged tool logic), effectively turning a read-only credential into an admin-equivalent one for this specific tool. The attacker gains configuration tampering and denial-of-service capability without needing to compromise credentials beyond a standard authenticated session.

Affected Systems

ArcadeDB; protocols: MCP

Detection Signatures

• Log entries showing set_server_setting invocations from non-admin/read-only authenticated principals
• MCP tool call audit logs where caller role != admin but tool executed successfully
• Unexpected changes to GlobalConfiguration values correlated with non-root allowedUsers sessions
• Monitor for allowAdmin=true combined with non-trivial allowedUsers configuration in deployment configs

Remediation Steps

1. 1

   Upgrade ArcadeDB

   Update to version 26.8.1 or later, which enforces per-caller role checks in SetServerSettingTool.execute().

2. 2

   Restrict allowAdmin flag

   Until patched, set allowAdmin=false or restrict allowedUsers to only trusted administrative accounts to eliminate the exposure window.

3. 3

   Audit MCP tool invocations

   Review MCP server access logs for prior set_server_setting calls made by non-admin accounts to detect potential exploitation.

4. 4

   Apply least-privilege tool exposure

   Segment MCP tool registration so that administrative tools like set_server_setting are only exposed to sessions with verified admin roles at the transport layer, not just an application flag.