CVE-2026-76224
HighCVSS 8.8Summary
ArcadeDB before 26.8.1 contains a remote code execution vulnerability in its Gremlin query engine. Although the engine defaults to the secure java engine, ArcadeGremlin.executeStatement() silently falls back to the insecure Groovy engine when a request carries query parameters and the query does not parse as gremlin-lang. An authenticated user with any database role, including read-only, can execute arbitrary OS commands as the ArcadeDB server process user.
Risk Assessment
An attacker can take over the ArcadeDB server by executing arbitrary commands, leading to full compromise of the system and data.
Recommendation
Upgrade ArcadeDB to version 26.8.1 or later, which includes the fix. Additionally, restrict Gremlin query access to trusted users only.
Original NVD description (English source)
ArcadeDB before 26.8.1 (arcadedb-gremlin, affected <= 26.7.3) contains a remote code execution vulnerability in its Gremlin query engine. Although the engine defaults to the documented-secure java (gremlin-lang) engine, ArcadeGremlin.executeStatement() silently falls back to the insecure Groovy engine whenever a request carries any query parameter and the query does not parse as gremlin-lang. An authenticated user with any database role, including a read-only reader, can submit a parameterized Gremlin query to trigger the Groovy fallback and execute arbitrary operating system commands as the ArcadeDB server process user.