CVE-2026-75853 Overview
CVE-2026-75853 is a missing authorization vulnerability [CWE-862] in ArcadeDB's Gremlin wire-protocol plugin (com.arcadedb:arcadedb-gremlin) affecting versions <= 26.7.3. The plugin enforces SASL PLAIN authentication but skips authorization checks entirely. It never invokes canAccessToDatabase and never binds the authenticated principal into the Gremlin engine. Any valid server credential can read, write, or drop data in any database on the server by targeting it through a traversal-source alias. The flaw bypasses per-type, read-only, and UPDATE_SCHEMA access control lists (ACLs). ArcadeDB fixed the issue in version 26.8.1.
Critical Impact
Any authenticated user, including accounts scoped to a single unrelated database, can access, modify, or drop every database on the ArcadeDB server.
Affected Products
- ArcadeDB Gremlin wire-protocol plugin com.arcadedb:arcadedb-gremlin versions <= 26.7.3
- ArcadeDB server deployments exposing the Gremlin endpoint
- Fixed in ArcadeDB Gremlin plugin version 26.8.1
Discovery Timeline
- 2026-08-18 - CVE-2026-75853 published to NVD
- 2026-08-18 - Last updated in NVD database
Technical Details for CVE-2026-75853
Vulnerability Analysis
The Gremlin wire-protocol plugin implements the authentication half of the SASL PLAIN exchange but omits the authorization half. After validating credentials, the plugin does not associate the authenticated principal with the traversal session. Every subsequent traversal executes under an unrestricted context. Callers select a target database by supplying a traversal-source alias in the Gremlin request. Because the engine never calls canAccessToDatabase, the alias resolves to any database on the server regardless of the caller's provisioned scope.
The result is a cross-database authorization bypass. An account provisioned for zero databases or a single unrelated database gains full read, write, schema-modification, and drop rights across every database. The engine's per-type ACLs, read-only flags, and UPDATE_SCHEMA restrictions are all bypassed because they rely on the missing principal binding.
Root Cause
The root cause is missing authorization logic in the Gremlin plugin's session initialization path. The SASL PLAIN handler treats successful authentication as sufficient and never propagates the principal into the Gremlin GraphTraversalSource used to execute traversals. Access control decisions downstream have no identity to evaluate against.
Attack Vector
An attacker needs network reachability to the Gremlin endpoint and one valid credential of any privilege level. The attacker completes the SASL PLAIN handshake, then issues a Gremlin query using a traversal-source alias that points to the victim database. The server executes the traversal without validating that the authenticated principal is authorized for that database, returning results or applying mutations directly. See the GitHub Security Advisory and the VulnCheck Advisory on ArcadeDB for the exploitation details.
Detection Methods for CVE-2026-75853
Indicators of Compromise
- Gremlin traversals that reference database aliases outside the authenticated account's provisioned scope
- Schema modification or drop() operations executed against databases by low-privilege accounts
- Successful SASL PLAIN authentication followed by cross-database traversal-source binding requests
Detection Strategies
- Enable Gremlin request logging on the ArcadeDB server and correlate the authenticated principal with the target database alias in each traversal
- Alert on any traversal where the resolved database name does not match the caller's authorized database list
- Baseline expected Gremlin query patterns per service account and flag deviations, especially write, schema, or drop operations
Monitoring Recommendations
- Forward ArcadeDB server logs to a centralized logging platform for retention and analytics
- Monitor for unusual bursts of traversal errors or schema-change events that may indicate probing
- Track outbound data volume from the Gremlin endpoint to identify bulk exfiltration through cross-database reads
How to Mitigate CVE-2026-75853
Immediate Actions Required
- Upgrade the ArcadeDB Gremlin plugin com.arcadedb:arcadedb-gremlin to version 26.8.1 or later
- Rotate all ArcadeDB server credentials, since any valid credential could have been used to access unrelated databases
- Audit database contents and schemas for unauthorized modifications, unexpected new types, or missing records
Patch Information
ArcadeDB addressed CVE-2026-75853 in version 26.8.1 of the arcadedb-gremlin plugin by binding the authenticated principal into the Gremlin engine and enforcing canAccessToDatabase before resolving traversal-source aliases. Details are documented in the GitHub Security Advisory GHSA-c287-v325-j5jx.
Workarounds
- Disable the Gremlin wire-protocol plugin on affected servers until the upgrade to 26.8.1 is completed
- Restrict network access to the Gremlin endpoint using firewall rules or reverse-proxy allowlists limited to trusted application hosts
- Remove or reduce the number of provisioned server credentials to minimize the pool of accounts that could exploit the bypass
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
