Is CVE-2026-114059 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-114059?

CVE-2026-114059 has a CVSS v3 severity of HIGH (7.5).

Back

CVE-2026-114059

Description

ArcadeDB before 26.10.1 contains a remote code execution vulnerability that allows authenticated users, including read-only reader role holders, to execute Groovy code because GremlinQueryEngine.command() lacks scripting authorization checks. Attackers can submit Gremlin commands to the POST /api/v1/command/{database} endpoint when the Groovy engine is enabled to run OS commands as the server process user.