Chow8386

**Name of the Vulnerable Software and Affected Versions** ArcadeDB versions prior to 26.8.1 **Description** The Gremlin query engine contains a flaw where the `ArcadeGremlin.executeStatement()` function silently reverts to an insecure Groovy engine if a request includes any query parameter and the query fails to parse as gremlin-lang, despite the default being the secure java engine. An authenticated user with any database role, including read-only access, can exploit this by submitting a parameterized Gremlin query to execute arbitrary operating system commands with the privileges of the ArcadeDB server process user. **Recommendations** Update ArcadeDB to version 26.8.1 or later.

**Name of the Vulnerable Software and Affected Versions** ArcadeDB versions prior to 26.8.1 **Description** The MongoDB wire-protocol plugin fails to enforce SASL (Simple Authentication and Security Layer) authentication on data commands. This allows unauthenticated attackers to connect to port 27017 without credentials and execute commands such as insert, find, update, delete, and create against any database. **Recommendations** Update to version 26.8.1 or later.