CVE-2026-114059

Deferred Deferred - Pending Action

Remote Code Execution in ArcadeDB

Publication date: 2026-10-21

Last updated on: 2026-10-28

Assigner: VulnCheck

Description

ArcadeDB before 26.10.1 contains a remote code execution vulnerability that allows authenticated users, including read-only reader role holders, to execute Groovy code because GremlinQueryEngine.command() lacks scripting authorization checks. Attackers can submit Gremlin commands to the POST /api/v1/command/{database} endpoint when the Groovy engine is enabled to run OS commands as the server process user.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-28

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-08

NVD

CVE-2026-114059

EUVD

EUVD-2026-107010

Affected Vendors & Products

Vendor	Product	Version / Range
ArcadeData	arcadedb	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

CVE-2026-114059 is a remote code execution vulnerability in ArcadeDB versions before 26.10.1. It allows authenticated users, including those with read-only access, to execute arbitrary Groovy code on the server via the POST /api/v1/command/{database} endpoint. The issue occurs because the GremlinQueryEngine lacks scripting authorization checks before sending commands to the Groovy engine, which can then run OS commands as the server process user.

The vulnerability is structural as the Groovy engine's security measures are ineffective against RCE. Attackers can gain full control over the server, including filesystem access, network operations, and privilege escalation.

Detection Guidance

To detect this vulnerability, check if ArcadeDB versions before 26.10.1 are running with the Groovy engine enabled. Inspect server configurations for the com.arcadedb:arcadedb-gremlin package up to 26.9.1. Monitor POST requests to /api/v1/command/{database} endpoints for unauthorized Groovy command submissions.

Impact Analysis

If you use ArcadeDB with the Groovy engine enabled, an attacker with valid credentials could execute malicious code on your server. This could lead to data theft, unauthorized system access, or complete server compromise. Even read-only users can exploit this vulnerability to gain full control.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements and HIPAA's security rules. A successful exploit may result in data breaches, triggering mandatory breach notifications and potential fines under these regulations.

Mitigation Strategies

Immediately disable the Groovy engine in ArcadeDB configurations. Restrict UPDATE_DATABASE_SETTINGS permissions to prevent command execution. Upgrade to a patched version if available. If no patch exists, consider isolating the server or migrating to an alternative database system.

Hi! I’m here to help you understand CVE-2026-114059. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...