CVE-2026-75853 ArcadeData CVE debrief

Who should care

Defenders responsible for ArcadeDB deployments, database administrators, and security teams should assess exposure and apply the fix to prevent unauthorized database access. They should also review database access controls, monitor for suspicious activity, and update incident response plans. Additionally, they should conduct a risk assessment to identify potential impacts and prioritize remediation efforts based on the severity of the vulnerability and the

Why it matters

The authorization bypass vulnerability in ArcadeDB's Gremlin wire-protocol plugin allows any valid server credential to access and manipulate data in any database on the server, bypassing existing ACLs.

• Potential unauthorized data access and modification
• Bypassing of per-type/read-only/UPDATE_SCHEMA ACLs
• Cross-database access and manipulation
• Verification of exposure and remediation priority

Technical summary

The ArcadeDB Gremlin wire-protocol plugin (com.arcadedb:arcadedb-gremlin) in versions <= 26.7.3 does not perform authorization checks, allowing any valid server credential to access any database on the server. This bypasses per-type, read-only, and UPDATE_SCHEMA ACLs, enabling attackers to read, write, and drop data across databases. The issue arises from the plugin's failure to bind authenticated principals to the engine and check database access permissions. The vulnerability is addressed in version 26.8.1, which includes authorization checks.

Defensive priority

Defenders should prioritize verifying exposure and applying the vendor-provided fix, as the vulnerability allows unauthorized database access.

Recommended defensive actions

• Verify the version of the ArcadeDB Gremlin wire-protocol plugin and apply the fix (upgrade to version 26.8.1 or later) if vulnerable.
• Review and restrict database access permissions to prevent unauthorized access.
• Monitor database activity for suspicious behavior.
• Perform a thorough review of existing database access controls and update them as necessary.
• Implement additional monitoring and logging to detect potential unauthorized access.
• Review and update incident response plans to include procedures for handling potential data breaches.
• Conduct a thorough risk assessment to identify potential impacts on the organization.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description and CVSS score. However, additional information from the vendor and other sources may be necessary to fully understand the issue.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.