CVE-2026-75853: ArcadeDB Gremlin Wire Protocol Authorization Bypass Cross-Database
ArcadeDB's Gremlin wire-protocol plugin (com.arcadedb:arcadedb-gremlin) in versions <= 26.7.3 enforces authentication (SASL PLAIN) but performs no authorization: it never checks database access permissions (canAccessToDatabase) and never binds the authenticated principal into the engine. As a result, any valid server credential — even one provisioned for zero or one unrelated database — can read, write, and drop data in any database on the server by selecting a target database via a traversal-source alias, completely bypassing the engine's per-type/read-only/UPDATESCHEMA ACLs. The issue is fixed in version 26.8.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
com.arcadedb:arcadedb-gremlinto a version that resolves this vulnerability.Fixed in 26.8.1
Event History
Frequently Asked Questions
Which deployments are affected, and what version fixes the issue?
Servers running the Gremlin wire-protocol plugin in versions 26.7.3 or earlier are affected. The issue is fixed in version 26.8.1.
What access does an attacker need to exploit this?
An attacker needs any valid server credential that can authenticate through SASL PLAIN. That credential may have access to no databases or only an unrelated database; no additional user interaction is required.
What protections are bypassed after authentication?
The affected plugin does not enforce database access permissions or bind the authenticated principal into the engine. An authenticated user can select another database through a traversal-source alias and bypass per-type, read-only, and UPDATE_SCHEMA ACLs.
What can be done if an immediate upgrade is not possible?
Upgrade the Gremlin plugin to version 26.8.1. Until then, limiting or disabling access to the Gremlin wire-protocol service reduces exposure because exploitation requires successful authentication to that interface.