CVE-2026-114059: ArcadeDB remote code execution in Gremlin Groovy engine

CVE-2026-114059 · Severity: high · CVSS 7.5 · Published 2026-10-21

ArcadeDB is a graph database platform used for storing and querying interconnected data. When the Gremlin Groovy engine is enabled, authenticated users with minimal privileges—including read-only accounts—can execute arbitrary code on the server and run OS commands as the database process user. This allows attackers with basic database access to take complete control of the underlying system.

Technologies: ArcadeData ArcadeDB. Vendors: ArcadeData.

Quick answers

Is CVE-2026-114059 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-114059 being exploited in the wild.
How severe is CVE-2026-114059?
High severity, with a CVSS score of 7.5, published 21 October 2026.
Which products and versions are affected?
ArcadeData ArcadeDB before 26.10.1.
Is there a fix for CVE-2026-114059?
Yes: fixed in 26.10.1. Until then: Do not enable the Groovy engine unless required; the default Java engine is not affected. If Groovy must be enabled, restrict the UPDATE_DATABASE_SETTINGS permission to trusted administrators only and ensure the UPDATE_SECURITY permission is never granted to users without full administrative intent. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-114059 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-114059?
Check whether you run ArcadeData ArcadeDB at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: 26.10.1

Do not enable the Groovy engine unless required; the default Java engine is not affected. If Groovy must be enabled, restrict the UPDATE_DATABASE_SETTINGS permission to trusted administrators only and ensure the UPDATE_SECURITY permission is never granted to users without full administrative intent.

Technical details

The GremlinQueryEngine.command() method lacks an authorization check equivalent to checkScriptingPermissions() found in PolyglotQueryEngine, allowing any authenticated user to submit Groovy scripts via POST /api/v1/command/{database} without verifying UPDATE_SECURITY permissions. The SecureASTCustomizer applied to the Groovy engine is documented by developers as ineffective against RCE and allows Closure type escapes. Exploitation requires valid credentials and the Groovy engine to be explicitly enabled (non-default), after which attackers gain arbitrary code execution as the server process user.

Affected products

  • ArcadeData ArcadeDB before 26.10.1

Timeline

  • 2026-10-05: disclosed
  • 2026-10-21: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.