---
id: "CVE-2026-114059"
kind: "vulnerability"
aliases: ["CVE-2026-114059"]
title: "ArcadeDB: read-only users can run Groovy code on the server"
severity: "high"
cvss: 7.7
epss: 0.00423
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["arcadedb", "database", "package", "self-hosted"]
not_affected_if: ["groovy-disabled", "no-untrusted-users"]
published_at: "2026-10-21T01:17:28+00:00"
first_seen_at: "2026-10-23T21:57:27+00:00"
updated_at: "2026-10-25T03:10:33+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114059", "first_seen_at": "2026-10-23T21:57:27+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-114059", "first_seen_at": "2026-10-24T13:15:55+00:00"}]
---

# ArcadeDB: read-only users can run Groovy code on the server

ArcadeDB before 26.10.1 lets any authenticated user, including read-only reader role holders, run Groovy code through the Gremlin command path because the scripting authorization check is missing. An attacker who can reach the command endpoint can run OS commands as the server process user.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Confirm the ArcadeDB server version (`unknown` if the install method is not stated) and check whether it is below `26.10.1`.
- Check whether the Groovy engine is enabled in the server configuration (`unknown` for the exact setting name; the sources do not name it).
- Check whether POST `/api/v1/command/{database}` is reachable from untrusted networks.

## Fix

- Upgrade ArcadeDB to `26.10.1` or later.
- Until upgraded, disable the Groovy engine if the setting is available (`unknown` for the exact setting), and restrict access to the command endpoint.

## Timeline

- 2026-10-23T21:57:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114059
- 2026-10-24T13:15:55+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-114059

## From the sources

ArcadeDB before 26.10.1 contains a remote code execution vulnerability that allows authenticated users, including read-only reader role holders, to execute Groovy code because GremlinQueryEngine.command() lacks scripting authorization checks. Attackers can submit Gremlin commands to the POST /api/v1/command/{database} endpoint when the Groovy engine is enabled to run OS commands as the server process user.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_