CVE-2026-76224: ArcadeDB Gremlin RCE Vulnerability

CVE-2026-76224 Overview

CVE-2026-76224 is a remote code execution vulnerability in ArcadeDB versions before 26.8.1, affecting the arcadedb-gremlin component at versions <= 26.7.3. The flaw resides in the Gremlin query engine. While ArcadeDB defaults to the documented-secure gremlin-lang (java) engine, the ArcadeGremlin.executeStatement() method silently falls back to the insecure Groovy engine when a request includes any query parameter and the query does not parse as gremlin-lang. An authenticated user holding any database role, including a read-only reader, can submit a parameterized Gremlin query to trigger the fallback and execute arbitrary operating system commands as the ArcadeDB server process user.

Critical Impact
Any authenticated ArcadeDB user, including read-only accounts, can achieve remote code execution on the database host by submitting a parameterized Gremlin query that triggers the Groovy engine fallback.

Affected Products

ArcadeDB versions prior to 26.8.1
arcadedb-gremlin component at versions <= 26.7.3
ArcadeDB deployments exposing the Gremlin query endpoint to authenticated users

Discovery Timeline

2026-08-19 - CVE-2026-76224 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-76224

Vulnerability Analysis

The vulnerability is a code injection flaw classified under [CWE-94]. ArcadeDB integrates Apache TinkerPop Gremlin to support graph queries and documents the gremlin-lang java engine as its secure default. This engine restricts language features to prevent arbitrary code execution.

The ArcadeGremlin.executeStatement() implementation contains fallback logic that undermines this default. When an incoming query carries any query parameter and the query text does not parse under gremlin-lang, execution silently transfers to the Groovy engine. Groovy is a full JVM scripting language and permits calls into arbitrary Java classes, including java.lang.Runtime and java.lang.ProcessBuilder.

Because the fallback is triggered by a parser failure combined with the presence of any parameter, attackers do not need to disable or reconfigure the secure engine. They only need to author input that fails gremlin-lang parsing while being valid Groovy. The commands run under the identity of the ArcadeDB server process, granting the attacker whatever filesystem, network, and privilege scope that account holds.

Root Cause

The root cause is insecure default behavior in the query engine dispatch logic. The engine selection function treats a parse failure in gremlin-lang as a signal to retry with Groovy rather than as an authoritative rejection. This design decision converts a hardened default into an opt-out that any client can trigger by sending a query parameter.

Attack Vector

The attack requires network access to the ArcadeDB Gremlin endpoint and a valid credential for any database role. The reader role is sufficient, meaning least-privilege accounts do not mitigate exposure. The attacker submits a parameterized POST request to the Gremlin endpoint containing a Groovy payload that invokes runtime command execution. The Groovy engine evaluates the payload, and the target host executes the embedded operating system commands. See the GitHub Security Advisory and the VulnCheck Advisory for technical details.

Detection Methods for CVE-2026-76224

Indicators of Compromise

Child processes spawned by the ArcadeDB JVM process, particularly shells (sh, bash, cmd.exe, powershell.exe) or command interpreters not part of normal database operation.
HTTP POST requests to Gremlin query endpoints containing Groovy-specific tokens such as Runtime.getRuntime(), ProcessBuilder, execute(), or System.getenv().
Outbound network connections from the ArcadeDB host to attacker-controlled infrastructure following Gremlin API activity.
ArcadeDB access logs showing parameterized Gremlin queries from low-privilege reader accounts.

Detection Strategies

Monitor process ancestry for the ArcadeDB Java process and alert on any non-JVM child process creation.
Inspect Gremlin query traffic for syntax patterns that fail gremlin-lang grammar but match Groovy constructs.
Correlate authentication events for reader-role accounts with subsequent parameterized Gremlin requests.

Monitoring Recommendations

Enable verbose ArcadeDB query logging and forward events to a centralized SIEM for pattern analysis.
Alert on unexpected file writes under the ArcadeDB installation directory or /tmp originating from the server process.
Track network egress from database hosts, which should typically have restricted outbound connectivity.

How to Mitigate CVE-2026-76224

Immediate Actions Required

Upgrade ArcadeDB to version 26.8.1 or later, which contains the fix for the Groovy fallback behavior.
Restrict network access to the ArcadeDB Gremlin endpoint using firewall rules or network segmentation until the patch is applied.
Audit existing ArcadeDB user accounts and revoke unnecessary reader-role credentials.
Rotate credentials and inspect the database host for signs of prior exploitation, including unexpected processes, cron entries, and outbound connections.

Patch Information

The vendor released ArcadeDB 26.8.1 to address CVE-2026-76224. Consult the GitHub Security Advisory GHSA-wcm5-4wjm-9wj3 for release notes and upgrade guidance. Verify the deployed arcadedb-gremlin artifact is above version 26.7.3 after the upgrade.

Workarounds

Disable the Gremlin plugin entirely if graph query functionality is not required by application workloads.
Enforce network-level restrictions so only trusted application services can reach the ArcadeDB API surface.
Run the ArcadeDB server process under a dedicated low-privilege operating system account with no shell access and no write permissions outside the data directory.

bash

# Configuration example: run ArcadeDB under a restricted service account
# and disable the Gremlin plugin in server settings
useradd --system --shell /usr/sbin/nologin --home /var/lib/arcadedb arcadedb
chown -R arcadedb:arcadedb /var/lib/arcadedb

# In config/arcadedb-server.json, remove or comment the Gremlin plugin
# "server.plugins": ""