CVE-2026-114059 ArcadeDB before 26.10.1 RCE via Gremlin Groovy Engine Missing Authorization
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-114059?
CVE-2026-114059 is a high-severity vulnerability in ArcadeData arcadedb, published on 21 Oct 2026.
Official description
ArcadeDB before 26.10.1 contains a remote code execution vulnerability that allows authenticated users, including read-only reader role holders, to execute Groovy code because GremlinQueryEngine.command() lacks scripting authorization checks. Attackers can submit Gremlin commands to the POST /api/v1/command/{database} endpoint when the Groovy engine is enabled to run OS commands as the server process user.
Weakness: CWE-863
Which versions are affected by CVE-2026-114059?
How do I fix CVE-2026-114059?
No fix has been published for CVE-2026-114059 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-114059 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-114059 exists.
Sources
Also known as GHSA-2mgh-5pqv-xpqq, GHSA-h2j4-28h8-cj5v.