{"id":"CVE-2026-114059","kind":"vulnerability","aliases":["CVE-2026-114059"],"related":[],"title":"ArcadeDB: read-only users can run Groovy code on the server","description":"ArcadeDB before 26.10.1 contains a remote code execution vulnerability that allows authenticated users, including read-only reader role holders, to execute Groovy code because GremlinQueryEngine.command() lacks scripting authorization checks. Attackers can submit Gremlin commands to the POST /api/v1/command/{database} endpoint when the Groovy engine is enabled to run OS commands as the server process user.","summary":"ArcadeDB before 26.10.1 lets any authenticated user, including read-only reader role holders, run Groovy code through the Gremlin command path because the scripting authorization check is missing. An attacker who can reach the command endpoint can run OS commands as the server process user.","severity":"high","cvss":7.7,"epss":0.00423,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["arcadedb","database","package","self-hosted"],"not_affected_if":["groovy-disabled","no-untrusted-users"],"how_to_check":"- Confirm the ArcadeDB server version (`unknown` if the install method is not stated) and check whether it is below `26.10.1`.\n- Check whether the Groovy engine is enabled in the server configuration (`unknown` for the exact setting name; the sources do not name it).\n- Check whether POST `/api/v1/command/{database}` is reachable from untrusted networks.","fix":"- Upgrade ArcadeDB to `26.10.1` or later.\n- Until upgraded, disable the Groovy engine if the setting is available (`unknown` for the exact setting), and restrict access to the command endpoint.","status":"open","published_at":"2026-10-21T01:17:28+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","triaged_at":"2026-10-25T03:10:33+00:00","updated_at":"2026-10-25T03:10:33+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:10:33Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade ArcadeDB to `26.10.1` or later.\n- Until upgraded, disable the Groovy engine if the setting is available (`unknown` for the exact setting), and restrict access to the command endpoint.","reach":"network","title":"ArcadeDB: read-only users can run Groovy code on the server","impact":"high","summary":"ArcadeDB before 26.10.1 lets any authenticated user, including read-only reader role holders, run Groovy code through the Gremlin command path because the scripting authorization check is missing. An attacker who can reach the command endpoint can run OS commands as the server process user.","category":"package","nicknames":[],"who_cares":["arcadedb","self-hosted","database"],"confidence":0.7,"needs_auth":"yes","worst_case":"Code runs as the server process user, with OS command execution","analyst_note":"Confirm the Groovy engine setting name and default state from the NVD entry or the ArcadeDB 26.10.1 release notes.","how_to_check":"- Confirm the ArcadeDB server version (`unknown` if the install method is not stated) and check whether it is below `26.10.1`.\n- Check whether the Groovy engine is enabled in the server configuration (`unknown` for the exact setting name; the sources do not name it).\n- Check whether POST `/api/v1/command/{database}` is reachable from untrusted networks.","needs_analyst":true,"not_affected_if":["groovy-disabled","no-untrusted-users"],"who_is_affected":"Teams running ArcadeDB servers before 26.10.1 with the Groovy engine enabled are exposed, and any account that can reach the command endpoint, including read-only users, can exploit it. Installations with the Groovy engine disabled or without authenticated access from untrusted users have less exposure, but the sources do not state how the default configuration behaves.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000674,"input_tokens":3396,"output_tokens":669,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-114059':15A,18A '-2026':14A,17A '/api/v1/command':109C '26.10.1':27B,73C 'allow':81C 'arcadedb':1A,19B,25B,71C 'attack':55B,101C 'authent':30B,82C 'author':50B,99C 'check':51B,100C 'code':9A,41B,77C,94C 'command':45B,60B,65B,105C,121C 'contain':74C 'cve':13A,16A 'databas':20B,110C 'enabl':117C 'endpoint':61B,111C 'engin':115C 'execut':78C,92C 'gremlin':44B,104C 'gremlinqueryengine.command':96C 'groovi':8A,40B,93C,114C 'holder':38B,90C 'host':24B 'includ':32B,84C 'lack':97C 'let':28B 'miss':53B 'os':64B,120C 'packag':21B 'path':46B 'post':108C 'process':69B,125C 'reach':58B 'read':3A,34B,86C 'read-on':2A,33B,85C 'reader':36B,88C 'remot':76C 'role':37B,89C 'run':7A,39B,63B,119C 'script':49B,98C 'self':23B 'self-host':22B 'server':12A,68B,124C 'submit':103C 'user':5A,31B,70B,83C,126C 'vulner':79C","nicknames":[],"mitigations":[],"who_affected":"Teams running ArcadeDB servers before 26.10.1 with the Groovy engine enabled are exposed, and any account that can reach the command endpoint, including read-only users, can exploit it. Installations with the Groovy engine disabled or without authenticated access from untrusted users have less exposure, but the sources do not state how the default configuration behaves.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T01:17:28+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114059","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114059","severity":null,"published_at":"2026-10-21T01:17:28+00:00","modified_at":"2026-10-21T01:17:29+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114059","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114059","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:55+00:00","fetched_at":"2026-10-24T13:15:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}