CVE-2026-114059 — ArcadeDB before 26.10.1 RCE via Gremlin Groovy Engine Missing Authorization
ArcadeDB before 26.10.1 contains a remote code execution vulnerability that allows authenticated users, including read-only reader role holders, to execute Groovy code because G…
Published: 2026-10-21 · CVSS: 7.7 · CVSS 4.0
ArcadeDB before 26.10.1 contains a remote code execution vulnerability that allows authenticated users, including read-only reader role holders, to execute Groovy code because GremlinQueryEngine.command() lacks scripting authorization checks. Attackers can submit Gremlin commands to the POST /api/v1/command/{database} endpoint when the Groovy engine is enabled to run OS commands as the server process user.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7