CVE-2026-76224

Name of the Vulnerable Software and Affected Versions ArcadeDB versions prior to 26.8.1

Description The Gremlin query engine contains a flaw where the ArcadeGremlin.executeStatement() function silently reverts to an insecure Groovy engine if a request includes any query parameter and the query fails to parse as gremlin-lang, despite the default being the secure java engine. An authenticated user with any database role, including read-only access, can exploit this by submitting a parameterized Gremlin query to execute arbitrary operating system commands with the privileges of the ArcadeDB server process user.

Recommendations Update ArcadeDB to version 26.8.1 or later.