Executive brief
ArcadeDB's Gremlin wire protocol is a database query interface that enforces user authentication but fails to enforce access controls. An attacker with any valid login credential—even one with access to just one database or none at all—can read, modify, and delete data in any database on the entire server by bypassing the built-in permission system. This completely compromises the security of multi-tenant deployments where databases should be isolated from each other.
Technical details
The vulnerability is a missing authorization check (CWE-862) in the Gremlin wire-protocol plugin's authentication handler. The GremlinServerAuthenticator authenticates users via SASL PLAIN but never validates which databases a user is permitted to access. When a client selects a target database via a traversal-source alias, ArcadeGraphManager.getOrCreateArcadeGraph() opens the database without calling canAccessToDatabase(). Furthermore, the authenticated principal is never bound to the engine context, so all downstream per-type/read-only/UPDATE_SCHEMA ACL checks fail because they treat the user as null and early-return ALLOW. Attack is network-accessible, requires only a valid low-privilege credential, and grants full read/write/drop access to all databases regardless of the user's intended permissions. Patch is available in version 26.8.1.
Affected products
- ArcadeData ArcadeDB Gremlin Plugin <=26.7.3
Timeline
- 2026-08-04: disclosed: GitHub security advisory published
- 2026-08-18: patched: Patched in version 26.8.1
- 2026-08-18: advisory: NVD entry published