CVE-2026-114059GHSA-h2j4-28h8-cj5v
ArcadeDB before 26.10.1 RCE via Gremlin Groovy Engine Missing Authorization
ArcadeData arcadedb
CVSS
7.7HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.42%Chance of exploitation activity in the next 30 days, higher than 35% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 26.10.1arcadedbCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
ArcadeDB before 26.10.1 contains a remote code execution vulnerability that allows authenticated users, including read-only reader role holders, to execute Groovy code because GremlinQueryEngine.command() lacks scripting authorization checks. Attackers can submit Gremlin commands to the POST /api/v1/command/{database} endpoint when the Groovy engine is enabled to run OS commands as the server process user.
Text from CVE List
Affected versions 2
- arcadedbaffected: all versions before 26.10.1CVE List
- arcadedbunaffected: 26.10.1CVE List