Description
ArcadeDB's Gremlin wire-protocol plugin (com.arcadedb:arcadedb-gremlin) in versions <= 26.7.3 enforces authentication (SASL PLAIN) but performs no authorization: it never checks database access permissions (canAccessToDatabase) and never binds the authenticated principal into the engine. As a result, any valid server credential — even one provisioned for zero or one unrelated database — can read, write, and drop data in any database on the server by selecting a target database via a traversal-source alias, completely bypassing the engine's per-type/read-only/UPDATE_SCHEMA ACLs. The issue is fixed in version 26.8.1.
Published: 2026-08-18
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

ArcadeDB’s Gremlin wire‑protocol plugin authenticates clients using SASL PLAIN but does not enforce any authorization; this allows any valid server credential to select any database through a traversal‑source alias, giving the attacker read, write, and drop privileges on all databases without restriction.

Affected Systems

ArcadeData ArcadeDB (com.arcadedb:arcadedb-gremlin) versions 26.7.3 and earlier are affected. The fix is available starting with version 26.8.1.

Risk and Exploitability

The vulnerability has a CVSS score of 8.7, indicating high severity. EPSS data is unavailable and the flaw is not listed in CISA’s KEV catalog. Because authentication succeeds for any credential, the bypass can be exploited remotely by anyone with valid SASL credentials, resulting in full compromise of all databases on the server.

Generated by OpenCVE AI on August 18, 2026 at 12:36 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade ArcadeDB to version 26.8.1 or later.
  • If an upgrade cannot be performed immediately, disable the Gremlin wire‑protocol plugin to prevent unauthorized traversal‑source alias usage.
  • Restrict or rotate SASL PLAIN credentials to limit access to only necessary accounts.
  • Monitor logs for unexpected database selections or traversal‑source alias activity.

Generated by OpenCVE AI on August 18, 2026 at 12:36 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 18 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 18 Aug 2026 13:45:00 +0000

Type Values Removed Values Added
First Time appeared Arcadedata
Arcadedata arcadedb
Vendors & Products Arcadedata
Arcadedata arcadedb

Tue, 18 Aug 2026 11:30:00 +0000

Type Values Removed Values Added
Description ArcadeDB's Gremlin wire-protocol plugin (com.arcadedb:arcadedb-gremlin) in versions <= 26.7.3 enforces authentication (SASL PLAIN) but performs no authorization: it never checks database access permissions (canAccessToDatabase) and never binds the authenticated principal into the engine. As a result, any valid server credential — even one provisioned for zero or one unrelated database — can read, write, and drop data in any database on the server by selecting a target database via a traversal-source alias, completely bypassing the engine's per-type/read-only/UPDATE_SCHEMA ACLs. The issue is fixed in version 26.8.1.
Title ArcadeDB Gremlin Wire Protocol Authorization Bypass Cross-Database
Weaknesses CWE-862
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Arcadedata Arcadedb
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-08-18T15:04:37.804Z

Reserved: 2026-08-18T11:03:08.681Z

Link: CVE-2026-75853

cve-icon Vulnrichment

Updated: 2026-08-18T15:03:09.569Z

cve-icon NVD

Status : Received

Published: 2026-08-18T12:19:35.727

Modified: 2026-08-18T15:17:14.903

Link: CVE-2026-75853

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-18T13:30:13Z

Weaknesses