CVE-2026-114059 Details
Description
ArcadeDB before 26.10.1 contains a remote code execution vulnerability that allows authenticated users, including read-only reader role holders, to execute Groovy code because GremlinQueryEngine.command() lacks scripting authorization checks. Attackers can submit Gremlin commands to the POST /api/v1/command/{database} endpoint when the Groovy engine is enabled to run OS commands as the server process user.
A remote code execution vulnerability has been identified in ArcadeDB versions prior to 26.10.1. This issue allows authenticated users, including those with the read-only 'reader' role, to execute arbitrary Groovy code. The vulnerability arises because the GremlinQueryEngine.command() method does not perform necessary scripting authorization checks. When the Groovy engine is enabled, attackers can send Gremlin commands to the POST /api/v1/command/{database} endpoint, executing OS commands as the user under which the ArcadeDB server process runs.
Users are advised to update ArcadeDB to version 26.10.1 or later, where this vulnerability has been addressed. As an interim measure, the Gremlin engine can be set to the default 'java' option, preventing the execution of Groovy scripts.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 21, 2026CISA-ADP
Assessed Oct 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-h2j4-28h8-cj5v | CISA-ADP | AdvisoryExploitTechnical AnalysisVendor |
| https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-h2j4-28h8-cj5v | [email protected] | AdvisoryExploitTechnical AnalysisVendor |
| https://www.vulncheck.com/advisories/arcadedb-before-26.10.1-rce-via-gremlin-groovy-engine-missing-authorization | [email protected] | AdvisoryVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ArcadeDB | <= 26.9.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 28, 2026 | CVE Modified | CISA-ADP |
| Oct 21, 2026 | New CVE Received | [email protected] |