ArcadeDB versions prior to 26.7.3 contain a critical information disclosure vulnerability in the MCP get_server_settings tool. The tool leaks the arcadedb.ha.clusterToken in cleartext, exposing a sensitive cluster authentication secret. Attackers with MCP access can retrieve this token and use it alongside X-ArcadeDB-Cluster-Token and X-ArcadeDB-Forwarded-User HTTP headers to impersonate the root user. This allows full server compromise without requiring valid credentials. The vulnerability is tracked as CVE-2026-67357 and has been patched in ArcadeDB version 26.7.3. Multiple advisories have been published including from GitHub Security Advisories and VulnCheck.