CVE-2026-75853

creationtimestamp| type| source ---|---|--- 2026-08-18 12:33:25+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/5mp254ojityul 2026-08-18 13:01:09+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mtebkkadn72r...

CVE-2026-75853

The com.arcadedb:arcadedb-gremlin plugin (≤26.7.3) enforces SASL PLAIN authentication but skips authorization: it never calls canAccessToDatabase or binds the principal, so any valid credential can read, write, and drop data in any database via a traversal-source alias, bypassing all per-type/rea...