CVE-2026-75853Disclosure

LOWCVSS 8.7 · HIGH

Signal is active with 2 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

ArcadeDB's Gremlin wire-protocol plugin (com.arcadedb:arcadedb-gremlin) in versions <= 26.7.3 enforces authentication (SASL PLAIN) but performs no authorization: it never checks database access permissions (canAccessToDatabase) and never binds the authenticated principal into the engine. As a result, any valid server credential — even one provisioned for zero or one unrelated database — can read, write, and drop data in any database on the server by selecting a target database via a traversal-source alias, completely bypassing the engine's per-type/read-only/UPDATE_SCHEMA ACLs. The issue is fixed in version 26.8.1.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-862

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

2 mentions across 1 observed day

What's happening

Technical details provided in 1 signal
Disclosure: 2 classified signals
2 total mentions across 1 day

Deep dive

Activity timeline2 mentions / 1d

Signal classification1 categories

Disclosure

2100.0%

Referenced assets3 URLs

By indicator

Full discourse2 posts

ThreatAft@ThreatAft46d
Disclosure
🔐🚨 ArcadeDB Mass Disclosure — 6 CVEs, CVSS 9.8 PEAK CVE-2026-75854 (9.8): Redis plugin — no authentication CVE-2026-75853 (8.8): Gremlin auth, no authz → https://threataft.com/articles/arcadedb-mass-disclosure-6-cves #cybersecurity #infosec #ArcadeDB #Redis #Gremlin #DatabaseSecurity #CVSS9 #ThreatIntel
Post summary
The post announces six newly disclosed ArcadeDB CVEs, providing their CVSS scores and brief descriptions of authentication/authorization-related weaknesses.
0000037
37 followersView on X
Vulmon Vulnerability Feed@VulmonFeeds46d
Disclosure
CVE-2026-75853 ArcadeDB Gremlin Plugin Authorization Bypass Allows Data ... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-75853 Don't wait vulnerability scanning results: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=2
Post summary
The tweet merely announces the existence of a new ArcadeDB vulnerability (CVE‑2026‑75853) with an authorization bypass description and points to a generic vulnerability details page, offering no further technical or exploitation information.
0000087
4.1K followersView on X

Explore more

Back to dashboard