CVE-2026-75855 ArcadeDB before 26.8.1 Path Traversal via create/drop database

ArcadeDB versions before 26.8.1 fail to sanitize database names in the POST /api/v1/server endpoint's create database and drop database commands, allowing authenticated root users to write and delete arbitrary files outside the configured database directory. Attackers can supply database names...

CVE-2026-75854

ArcadeDB versions before 26.8.1 expose a missing authentication flaw in the Redis wire-protocol plugin. Network attackers can connect to the Redis port with no credentials and read, write, or delete data across any server database, scoring CVSS 9.8 (CRITICAL). No exploitation evidence is provided...

CVE-2026-75854 ArcadeDB Redis Wire-Protocol Plugin Missing Authentication

ArcadeDB versions before 26.8.1 contain a missing authentication vulnerability in the Redis wire-protocol plugin that allows unauthenticated attackers to read, write, and delete data. Attackers can connect to the Redis port and execute arbitrary commands against any database on the server without...

CVE-2026-75854 ArcadeDB Redis Wire-Protocol Plugin Missing Authentication

ArcadeDB versions before 26.8.1 contain a missing authentication vulnerability in the Redis wire-protocol plugin that allows unauthenticated attackers to read, write, and delete data. Attackers can connect to the Redis port and execute arbitrary commands against any database on the server without...

CVE-2026-75855 ArcadeDB before 26.8.1 Path Traversal via create/drop database

ArcadeDB versions before 26.8.1 fail to sanitize database names in the POST /api/v1/server endpoint's create database and drop database commands, allowing authenticated root users to write and delete arbitrary files outside the configured database directory. Attackers can supply database names...

EUVD-2026-60615

ArcadeDB versions before 26.8.1 contain a missing authentication vulnerability in the Redis wire-protocol plugin that allows unauthenticated attackers to read, write, and delete data. Attackers can connect to the Redis port and execute arbitrary commands against any database on the server without...

CVE-2026-75854 ArcadeDB Redis Wire-Protocol Plugin Missing Authentication

ArcadeDB versions before 26.8.1 contain a missing authentication vulnerability in the Redis wire-protocol plugin that allows unauthenticated attackers to read, write, and delete data. Attackers can connect to the Redis port and execute arbitrary commands against any database on the server without...

CVE-2026-75855 ArcadeDB before 26.8.1 Path Traversal via create/drop database

ArcadeDB versions before 26.8.1 fail to sanitize database names in the POST /api/v1/server endpoint's create database and drop database commands, allowing authenticated root users to write and delete arbitrary files outside the configured database directory. Attackers can supply database names...

CVE-2026-75855

ArcadeDB versions before 26.8.1 fail to sanitize database names in the POST /api/v1/server endpoint's create database and drop database commands, allowing authenticated root users to write and delete arbitrary files outside the configured database directory. Attackers can supply database names...

CVE-2026-75854

ArcadeDB versions before 26.8.1 contain a missing authentication vulnerability in the Redis wire-protocol plugin that allows unauthenticated attackers to read, write, and delete data. Attackers can connect to the Redis port and execute arbitrary commands against any database on the server without...

CVE-2026-75855

ArcadeDB versions before 26.8.1 do not sanitize database names in the POST /api/v1/server endpoint, allowing authenticated root users to supply ../ sequences for arbitrary file creation or recursive directory deletion. CVSS 8.7 HIGH; exploitation details not provided. Remediation is to upgrade to...

CVE-2026-75853 ArcadeDB Gremlin Wire Protocol Authorization Bypass Cross-Database

ArcadeDB's Gremlin wire-protocol plugin com.arcadedb:arcadedb-gremlin in versions = 26.7.3 enforces authentication SASL PLAIN but performs no authorization: it never checks database access permissions canAccessToDatabase and never binds the authenticated principal into the engine. As a result, an...

com.arcadedb:arcadedb-console (>=21.10.1, <=22.1.2), com.arcadedb:arcadedb-coverage (>=21.9.1-beta, <=25.4.1) +7 more potentially affected by CVE-2026-75853 via com.arcadedb:arcadedb-gremlin (>=21.9.1-beta, <=26.7.3)

com.arcadedb:arcadedb-gremlin MAVEN version =21.9.1-beta, =21.10.1, =21.9.1-beta, =21.12.1, =21.10.1, =21.9.1-beta, =21.9.1-beta, =21.9.1-beta, =21.9.1-beta, =21.9.1-beta, =22.1.2 Source cves: CVE-2026-75853 Source advisory: MEND:CVE-2026-75853...

EUVD-2026-60614

ArcadeDB's Gremlin wire-protocol plugin com.arcadedb:arcadedb-gremlin in versions = 26.7.3 enforces authentication SASL PLAIN but performs no authorization: it never checks database access permissions canAccessToDatabase and never binds the authenticated principal into the engine. As a result, an...

CVE-2026-75853 ArcadeDB Gremlin Wire Protocol Authorization Bypass Cross-Database

ArcadeDB's Gremlin wire-protocol plugin com.arcadedb:arcadedb-gremlin in versions = 26.7.3 enforces authentication SASL PLAIN but performs no authorization: it never checks database access permissions canAccessToDatabase and never binds the authenticated principal into the engine. As a result, an...

CVE-2026-75853 ArcadeDB Gremlin Wire Protocol Authorization Bypass Cross-Database

ArcadeDB's Gremlin wire-protocol plugin com.arcadedb:arcadedb-gremlin in versions = 26.7.3 enforces authentication SASL PLAIN but performs no authorization: it never checks database access permissions canAccessToDatabase and never binds the authenticated principal into the engine. As a result, an...

CVE-2026-75853

ArcadeDB's Gremlin wire-protocol plugin com.arcadedb:arcadedb-gremlin in versions = 26.7.3 enforces authentication SASL PLAIN but performs no authorization: it never checks database access permissions canAccessToDatabase and never binds the authenticated principal into the engine. As a result, an...

CVE-2026-75853

The com.arcadedb:arcadedb-gremlin plugin (≤26.7.3) enforces SASL PLAIN authentication but skips authorization: it never calls canAccessToDatabase or binds the principal, so any valid credential can read, write, and drop data in any database via a traversal-source alias, bypassing all per-type/rea...

CVE-2026-75851 ArcadeDB before 26.8.1 Authentication Bypass via Async Command

ArcadeDB server com.arcadedb:arcadedb-server in versions 26.7.3 and earlier fails to propagate the authenticated principal to asynchronous command worker threads. When an HTTP command is submitted with awaitResponse:false, it executes on an async worker whose DatabaseContext has no bound user,...

CVE-2026-75851

ArcadeDB server com.arcadedb:arcadedb-server in versions 26.7.3 and earlier fails to propagate the authenticated principal to asynchronous command worker threads. When an HTTP command is submitted with awaitResponse:false, it executes on an async worker whose DatabaseContext has no bound user,...