ArcadeDB Gremlin Plugin Missing Authorization Checks

ArcadeDB's Gremlin wire-protocol plugin (com.arcadedb:arcadedb-gremlin) in versions <= 26.7.3 enforces authentication (SASL PLAIN) but performs no authorization: it never checks database access permissions (canAccessToDatabase) and never binds the authenticated principal into the engine. As a result, any valid server credential — even one provisioned for zero or one unrelated database — can read, write, and drop data in any database on the server by selecting a target database via a traversal-source alias, completely bypassing the engine's per-type/read-only/UPDATE_SCHEMA ACLs. The issue is fixed in version 26.8.1.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

ArcadeDB's Gremlin wire-protocol plugin contains a critical authorization bypass vulnerability affecting versions 26.7.3 and earlier. While the plugin correctly implements SASL PLAIN authentication, it fails to enforce database-level access controls—meaning any authenticated user, regardless of their intended database permissions, can read, write, and drop data across all databases on a server. This is a textbook privilege escalation flaw that transforms a low-privilege credential into a super-user account. Organizations running ArcadeDB with multiple isolated databases are at significant risk, as database separation becomes illusory; attackers with any valid credential gain unrestricted lateral movement across the entire database cluster.

Casky's 283 matching skills detect the attack patterns underlying this vulnerability by mapping to MITRE ATT&CK techniques TA0004 (Privilege Escalation) and TA0006 (Credential Access). Practitioners using Casky would identify suspicious patterns such as: (1) authenticated Gremlin traversal queries targeting databases outside a user's provisioned scope, (2) unexpected database selection commands from low-privilege accounts, and (3) data exfiltration or modification operations succeeding despite authorization policies. The platform's extended reasoning capabilities help security teams correlate authentication logs with unauthorized database access attempts, distinguishing legitimate multi-database queries from exploitation attempts. Findings would highlight the absence of authorization enforcement in wire-protocol handlers—a critical control gap that requires immediate patching to versions 26.7.4 or later and network segmentation to limit Gremlin endpoint exposure.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-75853.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

cryptography · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-75853

Casky has 283 skills that investigate the attack patterns behind CVE-2026-75853. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn