CVE-2026-114059: ArcadeDB before 26.10.1 RCE via Gremlin Groovy Engine Missing Authorization

Q: Are read-only accounts sufficient to exploit this issue?

Yes. Authenticated users with the read-only reader role can execute Groovy code because the affected command path does not enforce scripting authorization checks.

Q: What conditions must be present for exploitation?

An attacker needs valid authentication and access to submit a Gremlin command to POST /api/v1/command/{database}. The Groovy engine must be enabled.

Q: Is user interaction required after an attacker submits a request?

No. The vulnerability has no user-interaction requirement.

Q: What level of access can successful exploitation provide?

Groovy code can be used to run operating-system commands as the user account running the ArcadeDB server process, affecting confidentiality, integrity, and availability.

Q: What version should be used to remediate the issue?

Upgrade ArcadeDB to version 26.10.1 or later. Versions before 26.10.1 are affected.

Published Oct 21, 2026

Updated

ArcadeDB before 26.10.1 contains a remote code execution vulnerability that allows authenticated users, including read-only reader role holders, to execute Groovy code because GremlinQueryEngine.command() lacks scripting authorization checks. Attackers can submit Gremlin commands to the POST /api/v1/command/{database} endpoint when the Groovy engine is enabled to run OS commands as the server process user.

Affected Software

1 affected component

ArcadeDB ArcadeDB<26.10.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ArcadeDB to a version that resolves this vulnerability.
Fixed in 26.10.1

Event History

Oct 21, 2026

CVE Published

via MITRE·12:36 AM

Data Sourced

via MITRE·12:36 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Are read-only accounts sufficient to exploit this issue?

Yes. Authenticated users with the read-only reader role can execute Groovy code because the affected command path does not enforce scripting authorization checks.

What conditions must be present for exploitation?

An attacker needs valid authentication and access to submit a Gremlin command to POST /api/v1/command/{database}. The Groovy engine must be enabled.

Is user interaction required after an attacker submits a request?

No. The vulnerability has no user-interaction requirement.

What level of access can successful exploitation provide?

Groovy code can be used to run operating-system commands as the user account running the ArcadeDB server process, affecting confidentiality, integrity, and availability.

What version should be used to remediate the issue?

Upgrade ArcadeDB to version 26.10.1 or later. Versions before 26.10.1 are affected.

CVE-2026-114059: ArcadeDB before 26.10.1 RCE via Gremlin Groovy Engine Missing Authorization

Affected Software

Remediation

Event History

Frequently Asked Questions

Are read-only accounts sufficient to exploit this issue?

What conditions must be present for exploitation?

Is user interaction required after an attacker submits a request?

What level of access can successful exploitation provide?

What version should be used to remediate the issue?

Company

Resources

Contact

Frequently Asked Questions

Are read-only accounts sufficient to exploit this issue?

What conditions must be present for exploitation?

Is user interaction required after an attacker submits a request?

What level of access can successful exploitation provide?

What version should be used to remediate the issue?