EUVD-2026-60614
GHSA-jfxf-4v73-8xw7
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible Gremlin endpoint (AV:N), any valid server credential suffices (PR:L), scope changes because authenticated access to one database grants unauthorized access across all database security boundaries (S:C), full CIA impact as attacker can read, write, and drop any database.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
ArcadeDB's Gremlin wire-protocol plugin (com.arcadedb:arcadedb-gremlin) in versions <= 26.7.3 enforces authentication (SASL PLAIN) but performs no authorization: it never checks database access permissions (canAccessToDatabase) and never binds the authenticated principal into the engine. As a result, any valid server credential - even one provisioned for zero or one unrelated database - can read, write, and drop data in any database on the server by selecting a target database via a traversal-source alias, completely bypassing the engine's per-type/read-only/UPDATE_SCHEMA ACLs. The issue is fixed in version 26.8.1.
AnalysisAI
Cross-database authorization bypass in ArcadeDB's Gremlin wire-protocol plugin allows any authenticated server user to fully access all databases on the server, completely circumventing per-database and per-type ACLs. Versions 26.7.3 and below of com.arcadedb:arcadedb-gremlin are affected; the plugin enforces SASL PLAIN authentication but never invokes the database permission check (canAccessToDatabase) nor binds the authenticated principal into the execution engine. No public exploit code has been identified at time of analysis, but exploitation requires only a single valid server credential regardless of what database that credential was originally provisioned for.
Technical ContextAI
ArcadeDB is a multi-model database (graph, document, key-value) that exposes a Gremlin query interface via the Apache TinkerPop binary wire protocol. The plugin artifact com.arcadedb:arcadedb-gremlin handles the protocol layer and is responsible for both authentication and authorization gating. The authentication step (SASL PLAIN credential verification) is correctly implemented, but the authorization step is entirely absent: the plugin never calls canAccessToDatabase to validate database-level permissions, and the authenticated principal is never bound to the engine context, meaning the engine has no identity to evaluate ACLs against. Traversal-source aliasing in Gremlin allows a client to target a specific named database at query time, and because no authorization check intercepts this selection, any database on the server becomes reachable. CPE cpe:2.3:a:arcadedata:arcadedb:*:*:*:*:*:*:*:* covers all ArcadeDB versions up through 26.7.3. CWE-862 (Missing Authorization) precisely describes the root cause: a security-relevant action (cross-database data access) is performed without verifying that the requesting principal has the right to perform it.
RemediationAI
The primary remediation is to upgrade com.arcadedb:arcadedb-gremlin to version 26.8.1, which contains the vendor-confirmed fix as documented in GHSA-c287-v325-j5jx at https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-c287-v325-j5jx. If an immediate upgrade is operationally blocked, the most effective compensating control is to disable or firewall the Gremlin wire-protocol endpoint entirely, restricting access to the Gremlin port to only trusted internal IP ranges or disabling the plugin if Gremlin functionality is not required - note this will break all Gremlin-based client integrations. A secondary control is to audit all server-level credentials and minimize the number of accounts that can authenticate to the ArcadeDB server, recognizing that any valid credential is sufficient for exploitation; however, this does not eliminate the vulnerability, only reduces the attacker surface. There is no known configuration flag within the plugin itself to enable authorization checks in versions prior to 26.8.1.
Unauthenticated data access and manipulation in ArcadeDB before 26.8.1 arises because the Redis wire-protocol plugin exp
Privilege escalation in ArcadeDB server (versions 26.7.3 and earlier) allows a low-privileged authenticated user with re
Privilege escalation in ArcadeDB before 26.8.1 lets a low-privileged authenticated reader escalate to full server admini
Authentication bypass in ArcadeDB before 26.8.1 lets unauthenticated attackers run full CRUD operations against any data
Scripting authorization bypass in ArcadeDB before 26.7.2 lets any authenticated database user - including read-only role
Cross-database authorization bypass (IDOR) in ArcadeDB before 26.7.2 lets attackers read and write any database on the s
Remote code execution in ArcadeDB's Gremlin query engine exposes any deployment running arcadedb-gremlin through version
Arbitrary file read in ArcadeDB before version 26.8.1 allows authenticated users holding trigger creation privileges to
Cluster token exposure in ArcadeDB before 26.7.2 enables any authenticated user to escalate privileges to root-level adm
Privilege escalation in ArcadeDB before 26.7.3 allows any user holding UPDATE_SCHEMA permission to create server-wide ad
Remote OS command execution in ArcadeDB before 26.7.2 is reachable by authenticated schema administrators through JavaSc
Authenticated low-privilege users can read and insert TimeSeries samples in ArcadeDB deployments running versions before
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today