Description

ArcadeDB's Gremlin wire-protocol plugin (com.arcadedb:arcadedb-gremlin) in versions <= 26.7.3 enforces authentication (SASL PLAIN) but performs no authorization: it never checks database access permissions (canAccessToDatabase) and never binds the authenticated principal into the engine. As a result, any valid server credential — even one provisioned for zero or one unrelated database — can read, write, and drop data in any database on the server by selecting a target database via a traversal-source alias, completely bypassing the engine's per-type/read-only/UPDATE_SCHEMA ACLs. The issue is fixed in version 26.8.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-18T12:19:35.727Z",
  "pubdate": "2026-08-18T12:19:35.727Z",
  "executiveSummary": "An authorization bypass vulnerability exists in ArcadeDB's Gremlin wire-protocol plugin (com.arcadedb:arcadedb-gremlin) affecting versions <= 26.7.3. The vulnerability stems from a fundamental flaw where the plugin enforces SASL PLAIN authentication but fails to perform subsequent authorization checks, omitting validation of database access permissions via canAccessToDatabase and failing to bind the authenticated principal into the execution engine. Consequently, any authenticated user possessing valid server credentials—regardless of whether those credentials are provisioned for zero or unrelated databases—can execute arbitrary read, write, and drop operations across any database hosted on the server. An attacker achieves this by targeting arbitrary databases through traversal-source aliases, completely bypassing the engine's intended per-type, read-only, and UPDATE_SCHEMA access control lists. This poses a severe risk to data confidentiality, integrity, and availability for all multitenant or enterprise deployments utilizing the Gremlin wire protocol. The issue requires upgrading to version 26.8.1 to remediate the missing authorization controls.",
  "technicalDetails": "The vulnerability resides within the Gremlin wire-protocol plugin component (com.arcadedb:arcadedb-gremlin) of ArcadeDB for versions <= 26.7.3. The root cause of the security defect is the decoupling of authentication from authorization within the protocol handler implementation. While the service correctly enforces connection-level authentication via the SASL PLAIN protocol mechanism, it suffers from a critical omission in access control logic: it never evaluates authorization permissions via the canAccessToDatabase routine, nor does it bind the successfully authenticated principal into the underlying database engine context.\nBecause the authenticated principal is not propagated or bound to the session execution context, the database engine executes incoming traversal requests without validating the caller's contextual privileges against the target database. The attack flow relies on exploiting this oversight by establishing an authenticated session using any legitimate server credential. Once authenticated, an attacker can bypass restrictions intended to limit access to specific databases by explicitly selecting any target database through a traversal-source alias during query execution.\nThis behavior allows low-privileged or restricted accounts—including those provisioned with no database access or access restricted to entirely unrelated databases—to interact with high-privilege datastores. The payload behavior bypasses all native engine-level access control lists (ACLs), including per-type restrictions, read-only constraints, and UPDATE_SCHEMA permissions. Consequently, post-exploitation impact includes unauthorized data exfiltration, arbitrary record modification, data deletion, and database destruction (dropping databases) across the entire ArcadeDB server instance. Network exposure is tied to the Gremlin wire-protocol listener, and exploitation requires valid server credentials to pass the initial SASL PLAIN authentication phase before leveraging the authorization bypass."
}