CVE-2026-114059 ArcadeData CVE debrief

Who should care

Defenders of systems using ArcadeDB, especially those with read-only user roles, should verify and apply the patch to prevent potential remote code execution. This includes reviewing compensating controls, monitoring for suspicious activity, and ensuring that access to vulnerable endpoints is restricted. Security teams should prioritize patching and verifying ArcadeDB versions to mitigate the risk of remote code execution.

Why it matters

CVE-2026-114059 is a high-severity vulnerability in ArcadeDB that allows authenticated users to execute Groovy code remotely. Defenders should verify and apply patch 26.10.1 or later, restrict access to vulnerable endpoints, and monitor for suspicious activity.

• Potential remote code execution as the server process user
• Ability for authenticated users, including read-only roles, to execute Groovy code
• Need for verification of ArcadeDB version and patch application
• Possible impact on systems with exposed endpoints

Technical summary

The CVE-2026-114059 vulnerability allows authenticated users to execute Groovy code via the GremlinQueryEngine.command() method due to missing authorization checks. This issue affects ArcadeDB versions before 26.10.1. The vulnerability has a CVSS score of 7.7 and is considered HIGH severity. Attackers can submit Gremlin commands to the POST /api/v1/command/{database} endpoint when the Groovy engine is enabled to run OS commands as the server process user. Official CVE Program and NVD records confirm a remote code execution vulnerability in ArcadeDB before 26.10.1.

Defensive priority

High

Recommended defensive actions

• Verify ArcadeDB version and apply patch 26.10.1 or later
• Restrict access to the POST /api/v1/command/{database} endpoint
• Monitor for suspicious Gremlin commands
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

Official CVE Program and NVD records confirm a remote code execution vulnerability in ArcadeDB before 26.10.1. Authenticated users, including read-only reader role holders, can execute Groovy code via GremlinQueryEngine.command() due to missing scripting authorization checks.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.