CVE-2026-76224: ArcadeDB before 26.8.1 Remote Code Execution via Groovy Fallback
ArcadeDB before 26.8.1 (arcadedb-gremlin, affected <= 26.7.3) contains a remote code execution vulnerability in its Gremlin query engine. Although the engine defaults to the documented-secure java (gremlin-lang) engine, ArcadeGremlin.executeStatement() silently falls back to the insecure Groovy engine whenever a request carries any query parameter and the query does not parse as gremlin-lang. An authenticated user with any database role, including a read-only reader, can submit a parameterized Gremlin query to trigger the Groovy fallback and execute arbitrary operating system commands as the ArcadeDB server process user.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated ArcadeDB user with any database role can exploit it, including a read-only reader. The attacker does not need elevated database privileges or user interaction.
Are default Gremlin engine settings sufficient to prevent exploitation?
No. The Gremlin query engine defaults to the documented-secure java (gremlin-lang) engine, but it silently falls back to the insecure Groovy engine when a request includes any query parameter and the query fails to parse as gremlin-lang.
What level of access does successful exploitation provide?
Successful exploitation allows arbitrary operating system command execution as the user account running the ArcadeDB server process. This can affect confidentiality, integrity, and availability of resources accessible to that account.
What version should be used to remediate the issue?
Upgrade ArcadeDB to version 26.8.1 or later. The affected arcadedb-gremlin component is identified as affected through version 26.7.3.