Description

ArcadeDB before 26.8.1 (arcadedb-gremlin, affected <= 26.7.3) contains a remote code execution vulnerability in its Gremlin query engine. Although the engine defaults to the documented-secure java (gremlin-lang) engine, ArcadeGremlin.executeStatement() silently falls back to the insecure Groovy engine whenever a request carries any query parameter and the query does not parse as gremlin-lang. An authenticated user with any database role, including a read-only reader, can submit a parameterized Gremlin query to trigger the Groovy fallback and execute arbitrary operating system commands as the ArcadeDB server process user.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-19T14:17:48.880Z",
  "pubdate": "2026-08-19T14:17:48.880Z",
  "executiveSummary": "An authenticated remote code execution vulnerability exists in the Gremlin query engine of ArcadeDB before version 26.8.1, specifically affecting arcadedb-gremlin versions 26.7.3 and prior. The vulnerability arises from an insecure fallback mechanism within the ArcadeGremlin.executeStatement() function, which switches from the secure java gremlin-lang engine to the insecure Groovy engine when a query containing parameters fails gremlin-lang parsing. An authenticated attacker possessing any database role, including a read-only reader, can exploit this behavior by submitting a crafted parameterized Gremlin query. Successful exploitation allows the attacker to achieve arbitrary operating system command execution under the security context of the ArcadeDB server process user. The risk is critical due to the potential for complete system compromise, bypassing intended database-level access controls through insecure script engine evaluation.",
  "technicalDetails": "The vulnerability resides in the ArcadeGremlin.executeStatement() component of ArcadeDB, which processes Gremlin graph traversal queries. By default, the query engine utilizes the secure java gremlin-lang engine. However, a critical logic flaw causes the engine to silently fall back to the insecure Groovy engine under specific conditions: whenever an incoming request contains any query parameter and the submitted query string fails to parse correctly as gremlin-lang.\nExploitation requires authentication to the database, but privilege requirements are minimal; any authenticated user, including those assigned restricted roles such as a read-only reader, can initiate the attack vector. The attack flow proceeds step-by-step as follows: first, the adversary crafts a malicious payload encapsulated within a parameterized Gremlin query designed to intentionally bypass or fail gremlin-lang parsing while supplying query parameters. Second, the adversary submits this query to the database server over the network interface handling query execution. Third, upon receiving the request, ArcadeGremlin.executeStatement() evaluates the query, triggers the parsing failure, and automatically invokes the Groovy fallback mechanism. Fourth, the insecure Groovy engine interprets and executes the malicious payload embedded in the query string.\nBecause the Groovy engine lacks the sandboxing and execution restrictions of the default gremlin-lang engine, the payload executes arbitrary operating system commands with the privileges of the underlying ArcadeDB server process user. Post-exploitation impact includes full system access, potential lateral movement within the network, data exfiltration, or manipulation of database files depending on the host system configuration and the privileges assigned to the service account running the ArcadeDB instance."
}