CVE-2026-114059— ArcadeDB before 26.10.1 RCE via Gremlin Groovy Engine Missing Authorization
Quick assessment
Affected
ArcadeData arcadedb
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 26.10.1 版本之前的 ArcadeDB 存在一个远程代码执行漏洞。由于 GremlinQueryEngine.command() 方法缺少脚本授权检查，该漏洞允许已认证用户（包括仅拥有只读 Reader 角色的用户）执行 Groovy 代码。当启用 Groovy 引擎时，攻击者可以向 POST /api/v1/command/{database} 接口提交 Gremlin 命令，从而以服务器进程用户的身份执行操作系统命令。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-114059
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
ArcadeDB before 26.10.1 RCE via Gremlin Groovy Engine Missing Authorization
Source: CVE Program / CVE List V5
Vulnerability Description
ArcadeDB before 26.10.1 contains a remote code execution vulnerability that allows authenticated users, including read-only reader role holders, to execute Groovy code because GremlinQueryEngine.command() lacks scripting authorization checks. Attackers can submit Gremlin commands to the POST /api/v1/command/{database} endpoint when the Groovy engine is enabled to run OS commands as the server process user.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不正确
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| ArcadeData | arcadedb | 0 ~ 26.10.1 | - |
|
II. Public POCs for CVE-2026-114059
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-114059
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-114059 (2)
Same Patch Batch · ArcadeData · 2026-10-21 · 4 CVEs total
| CVE-2026-114058 | 4.3 MEDIUM | ArcadeDB from 26.2.1 before 26.10.1 Missing Authorization via Bolt Protocol |
| CVE-2026-114056 | 4.3 MEDIUM | ArcadeDB from 26.8.1 before 26.10.1 Authorization Bypass via ALTER TYPE WITH |
| CVE-2026-114057 | 4.3 MEDIUM | ArcadeDB 26.2.1 before 26.10.1 Bolt SHOW DATABASES Information Disclosure |
IV. Related Vulnerabilities
Same product: arcadedb
-
CVE-2026-114058
ArcadeDB from 26.2.1 before 26.10.1 Missing Authorization vi -
CVE-2026-114057
ArcadeDB 26.2.1 before 26.10.1 Bolt SHOW DATABASES Informati -
CVE-2026-114056
ArcadeDB from 26.8.1 before 26.10.1 Authorization Bypass via -
CVE-2026-93598
ArcadeDB before 26.9.1 Classpath Credential Disclosure via R -
CVE-2026-93597
ArcadeDB before 26.9.1 SSRF via IPv6 transition addresses
Same vendor: ArcadeData
-
CVE-2026-114058
ArcadeDB from 26.2.1 before 26.10.1 Missing Authorization vi -
CVE-2026-114057
ArcadeDB 26.2.1 before 26.10.1 Bolt SHOW DATABASES Informati -
CVE-2026-114056
ArcadeDB from 26.8.1 before 26.10.1 Authorization Bypass via -
CVE-2026-93598
ArcadeDB before 26.9.1 Classpath Credential Disclosure via R -
CVE-2026-93597
ArcadeDB before 26.9.1 SSRF via IPv6 transition addresses
Same weakness: CWE-863
-
CVE-2026-114391
ZenTao PMS before 22.3 Authorization Bypass via Ajax Control -
CVE-2026-87096
Acronis Cyber Infrastructure 授权绕过致敏感信息泄露 -
CVE-2026-87095
Acronis Cyber Infrastructure 6.2.1 前版本越权漏洞 -
CVE-2026-71195
OpenStack Manila 23.0.1 前公开共享授权绕过漏洞 -
CVE-2026-114075
Trigger.dev before 4.5.12 Authorization Bypass via Alert Cha
V. Comments for CVE-2026-114059
No comments yet