CVE-2026-76224
Received Received - Intake

Remote Code Execution in ArcadeDB Gremlin Engine

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: VulnCheck

Description
ArcadeDB before 26.8.1 (arcadedb-gremlin, affected <= 26.7.3) contains a remote code execution vulnerability in its Gremlin query engine. Although the engine defaults to the documented-secure java (gremlin-lang) engine, ArcadeGremlin.executeStatement() silently falls back to the insecure Groovy engine whenever a request carries any query parameter and the query does not parse as gremlin-lang. An authenticated user with any database role, including a read-only reader, can submit a parameterized Gremlin query to trigger the Groovy fallback and execute arbitrary operating system commands as the ArcadeDB server process user.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-76224
EUVD
EUVD-2026-62465

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
arcadedb arcadedb to 26.8.1 (exc)
arcadedb arcadedb From 26.7.3 (inc) to 26.8.1 (exc)
arcadedb arcadedb-gremlin to 26.8.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

ArcadeDB before version 26.8.1 has a remote code execution vulnerability in its Gremlin query engine. The engine is supposed to use a secure Java-based Gremlin engine by default, but it silently falls back to an insecure Groovy engine when a query contains parameters and fails to parse as Java Gremlin. This allows authenticated users, even with read-only access, to execute arbitrary operating system commands as the ArcadeDB server process user.

Detection Guidance

To detect this vulnerability, check the ArcadeDB server version. If it is below 26.8.1, the system is likely vulnerable. Use commands like 'curl -s http://<server>:<port>/api/v1/server' or inspect the server logs for Gremlin query execution attempts that trigger the Groovy fallback.

Impact Analysis

An attacker with even minimal privileges can exploit this to execute arbitrary OS commands on the server running ArcadeDB. This could lead to full host compromise, including file read/write operations, command execution, and potential lateral movement within the network. The impact includes data theft, system takeover, and disruption of services.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating compliance requirements such as GDPR (data protection) and HIPAA (health information security). It may result in legal penalties, reputational damage, and loss of trust due to compromised sensitive data.

Mitigation Strategies

Immediately upgrade ArcadeDB to version 26.8.1 or later. If upgrading is not possible, disable the Groovy fallback in the Gremlin engine configuration or restrict access to authenticated users with minimal privileges. Review and remove any unnecessary database roles that could exploit this flaw.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-76224. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart