Live › vulnerability › CVE-2026-114059
Go to dashboardArcadeDB before 26.10.1 lets any authenticated user, including read-only reader role holders, run Groovy code through the Gremlin command path because the scripting authorization check is missing. An attacker who can reach the command endpoint can run OS commands as the server process user.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running ArcadeDB servers before 26.10.1 with the Groovy engine enabled are exposed, and any account that can reach the command endpoint, including read-only users, can exploit it. Installations with the Groovy engine disabled or without authenticated access from untrusted users have less exposure, but the sources do not state how the default configuration behaves.
No product ranges from the sources yet.
unknown if the install method is not stated) and check whether it is below 26.10.1.unknown for the exact setting name; the sources do not name it)./api/v1/command/{database} is reachable from untrusted networks.26.10.1 or later.unknown for the exact setting), and restrict access to the command endpoint.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
ArcadeDB before 26.10.1 contains a remote code execution vulnerability that allows authenticated users, including read-only reader role holders, to execute Groovy code because GremlinQueryEngine.command() lacks scripting authorization checks. Attackers can submit Gremlin commands to the POST /api/v1/command/{database} endpoint when the Groovy engine is enabled to run OS commands as the server process user.
This page as .md · .json · in your agent: get_signal("CVE-2026-114059")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.