CVE-2026-114059

ArcadeDB versions before 26.10.1 are vulnerable to remote code execution (RCE) due to missing scripting authorization checks in the GremlinQueryEngine.command() function. Authenticated users, including those with read-only reader roles, can submit Groovy code via the POST /api/v1/command/{databas...