# CVE-2026-75853: ArcadeDB Gremlin plugin authorization bypass across databases

Source: https://junglewise.ai/threats/cve-2026-75853-arcadedb-gremlin-plugin-authorization-bypass-across-databases  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-18. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-75853 · Severity: high · CVSS 8.8 · Published 2026-08-18

ArcadeDB's Gremlin wire protocol is a database query interface that enforces user authentication but fails to enforce access controls. An attacker with any valid login credential—even one with access to just one database or none at all—can read, modify, and delete data in any database on the entire server by bypassing the built-in permission system. This completely compromises the security of multi-tenant deployments where databases should be isolated from each other.

Vendors: [ArcadeData](https://junglewise.ai/threats/vendors/arcadedata).

## Quick answers

**Is CVE-2026-75853 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-75853 being exploited in the wild.

**How severe is CVE-2026-75853?** High severity, with a CVSS score of 8.8, published 18 August 2026.

**Which products and versions are affected?** ArcadeData ArcadeDB Gremlin Plugin <=26.7.3.

**Is there a fix for CVE-2026-75853?** A patch was published on 2026-08-18: Patched in version 26.8.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-75853 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-75853?** Check whether you run ArcadeData ArcadeDB Gremlin Plugin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a missing authorization check (CWE-862) in the Gremlin wire-protocol plugin's authentication handler. The GremlinServerAuthenticator authenticates users via SASL PLAIN but never validates which databases a user is permitted to access. When a client selects a target database via a traversal-source alias, ArcadeGraphManager.getOrCreateArcadeGraph() opens the database without calling canAccessToDatabase(). Furthermore, the authenticated principal is never bound to the engine context, so all downstream per-type/read-only/UPDATE_SCHEMA ACL checks fail because they treat the user as null and early-return ALLOW. Attack is network-accessible, requires only a valid low-privilege credential, and grants full read/write/drop access to all databases regardless of the user's intended permissions. Patch is available in version 26.8.1.

## Affected products

- ArcadeData ArcadeDB Gremlin Plugin <=26.7.3

## Timeline

- 2026-08-04: disclosed: GitHub security advisory published
- 2026-08-18: patched: Patched in version 26.8.1
- 2026-08-18: advisory: NVD entry published

## References

- [https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-c287-v325-j5jx](https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-c287-v325-j5jx)
- [https://www.vulncheck.com/advisories/arcadedb-gremlin-wire-protocol-authorization-bypass-cross-database](https://www.vulncheck.com/advisories/arcadedb-gremlin-wire-protocol-authorization-bypass-cross-database)