Attack Chain

1. Attacker authenticates to the target ArcadeDB server using valid (potentially low-privileged) credentials via the Gremlin wire-protocol.
2. Attacker establishes a session using the SASL PLAIN authentication mechanism.
3. Attacker identifies a target database on the server, potentially one they are not authorized to access.
4. Attacker uses a traversal-source alias to reference the unauthorized target database within the Gremlin query structure.
5. The plugin processes the request without performing an authorization check against the database engine.
6. The underlying engine executes the request with the context of the authenticated session, ignoring the intended ACL boundaries.
7. Attacker performs unauthorized actions such as data exfiltration (read), modification (write), or data destruction (drop).

Impact

Successful exploitation allows an attacker to bypass all database-level security restrictions. An attacker can gain unauthorized read/write/delete access to any database hosted on an instance where they possess valid credentials for at least one database. This impacts data confidentiality, integrity, and availability.

Recommendation

• Upgrade the arcadedb-gremlin plugin to version 26.8.1 or later.
• Audit database access logs for unusual cross-database traversals or queries initiated by accounts that should not have scope over the entire server.
• Apply the principle of least privilege by restricting user credentials to the minimum necessary databases until patches are deployed.