EUVD-2026-60614
GHSA-jfxf-4v73-8xw7
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible Gremlin endpoint (AV:N), any valid server credential suffices (PR:L), scope changes because authenticated access to one database grants unauthorized access across all database security boundaries (S:C), full CIA impact as attacker can read, write, and drop any database.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
ArcadeDB's Gremlin wire-protocol plugin (com.arcadedb:arcadedb-gremlin) in versions <= 26.7.3 enforces authentication (SASL PLAIN) but performs no authorization: it never checks database access permissions (canAccessToDatabase) and never binds the authenticated principal into the engine. As a result, any valid server credential - even one provisioned for zero or one unrelated database - can read, write, and drop data in any database on the server by selecting a target database via a traversal-source alias, completely bypassing the engine's per-type/read-only/UPDATE_SCHEMA ACLs. The issue is fixed in version 26.8.1.
AnalysisAI
Cross-database authorization bypass in ArcadeDB's Gremlin wire-protocol plugin allows any authenticated server user to fully access all databases on the server, completely circumventing per-database and per-type ACLs. Versions 26.7.3 and below of com.arcadedb:arcadedb-gremlin are affected; the plugin enforces SASL PLAIN authentication but never invokes the database permission check (canAccessToDatabase) nor binds the authenticated principal into the execution engine. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The Gremlin wire-protocol plugin (com.arcadedb:arcadedb-gremlin) must be installed and its network endpoint must be reachable by the attacker - environments that have not deployed this plugin are not affected. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) accurately represents the real-world risk profile. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has compromised a low-privilege ArcadeDB application account - provisioned only for a read-only analytics database - connects to the Gremlin wire-protocol port, authenticates successfully with those credentials via SASL PLAIN, and then issues Gremlin traversal queries targeting a sensitive HR or financial database by specifying its traversal-source alias. Because no authorization check is executed, the engine processes the queries in full, allowing the attacker to dump, modify, or destroy records in databases entirely outside the scope of their provisioned credential. … |
| Remediation | The primary remediation is to upgrade com.arcadedb:arcadedb-gremlin to version 26.8.1, which contains the vendor-confirmed fix as documented in GHSA-c287-v325-j5jx at https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-c287-v325-j5jx. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all ArcadeDB installations running versions 26.7.3 or below that use the Gremlin wire-protocol plugin; audit authentication logs and database access records for any cross-database activity indicating exploitation. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
OS command execution in ArcadeDB (arcadedb-engine) before 26.7.2 lets an authenticated user with UPDATE_SCHEMA permissio
Privilege escalation in ArcadeDB server (versions 26.7.3 and earlier) allows a low-privileged authenticated user with re
Privilege escalation in ArcadeDB before 26.8.1 lets a low-privileged authenticated reader escalate to full server admini
Scripting authorization bypass in ArcadeDB before 26.7.2 lets any authenticated database user - including read-only role
Cross-database authorization bypass (IDOR) in ArcadeDB before 26.7.2 lets attackers read and write any database on the s
Unauthenticated data access and manipulation in ArcadeDB before 26.8.1 arises because the Redis wire-protocol plugin exp
Authentication bypass in ArcadeDB before 26.8.1 lets unauthenticated attackers run full CRUD operations against any data
Cluster token exposure in ArcadeDB before 26.7.2 enables any authenticated user to escalate privileges to root-level adm
Privilege escalation in ArcadeDB before 26.7.3 allows any user holding UPDATE_SCHEMA permission to create server-wide ad
Remote code execution in ArcadeDB's Gremlin query engine exposes any deployment running arcadedb-gremlin through version
Arbitrary file read in ArcadeDB before version 26.8.1 allows authenticated users holding trigger creation privileges to
Permission bypass in ArcadeDB before 26.7.2 allows authenticated read-only users to execute privileged schema-mutation S
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today