ArcadeDB versions prior to 26.7.3 contain a critical authentication bypass vulnerability in the MCP HTTP transport layer. The flaw stems from a failure to bind the authenticated principal during MCP HTTP transport, causing all engine permission checks to silently pass as no-ops. This allows non-root MCP-allowed users to bypass all authorization controls. Attackers can exploit this to perform arbitrary database writes, execute DDL operations, perform schema mutations, and run arbitrary JavaScript code via the query tool. The vulnerability effectively grants unauthorized users elevated database privileges. A fix is available in ArcadeDB version 26.7.3 and later. The issue is tracked as CVE-2026-68578 and has been disclosed via GitHub Security Advisories and VulnCheck.