CVE-2026-114059

ArcadeDB versions before 26.10.1 are vulnerable to remote code execution (RCE) due to missing scripting authorization checks in the GremlinQueryEngine.command() function. Authenticated users, including those with read-only reader roles, can submit Groovy code via the POST /api/v1/command/{databas...

EUVD-2026-107010

ArcadeDB before 26.10.1 contains a remote code execution vulnerability that allows authenticated users, including read-only reader role holders, to execute Groovy code because GremlinQueryEngine.command lacks scripting authorization checks. Attackers can submit Gremlin commands to the POST...