Élevée
7.5
ArcadeDB before 26.10.1 contains a remote code execution vulnerability that allows authenticated...
CVE-2026-114059
Première détection SecPulse
Description d'origine La description telle que publiée par la source (souvent en anglais).
ArcadeDB before 26.10.1 contains a remote code execution vulnerability that allows authenticated users, including read-only reader role holders, to execute Groovy code because GremlinQueryEngine.command() lacks scripting authorization checks. Attackers can submit Gremlin commands to the POST /api/v1/command/{database} endpoint when the Groovy engine is enabled to run OS commands as the server process user.
Source: NIST National Vulnerability Database NVD GitHub Advisory
Références
- web github.com
- web vulncheck.com
- web nvd.nist.gov
- web github.com