CVE-2026-75853

Name of the Vulnerable Software and Affected Versions ArcadeDB Gremlin wire-protocol plugin (com.arcadedb:arcadedb-gremlin) versions prior to 26.8.1

Description The Gremlin wire-protocol plugin enforces authentication using SASL PLAIN but fails to perform authorization. The system does not verify database access permissions via the canAccessToDatabase check and does not bind the authenticated principal into the engine. Consequently, any user with valid server credentials can read, write, and drop data across any database on the server by selecting a target database through a traversal-source alias. This allows a complete bypass of the engine's Access Control Lists (ACLs), including per-type, read-only, and UPDATE SCHEMA restrictions.

Recommendations Update ArcadeDB Gremlin wire-protocol plugin (com.arcadedb:arcadedb-gremlin) to version 26.8.1.