CVE-2026-75844
ArcadeDB before 26.8.1 SSRF via IMPORT DATABASE validator bypass
- State
- Published
- Severity
- 7.1 High
- Published
- Aug 18, 2026
- Updated
- Aug 18, 2026
- Reserved
- Aug 18, 2026
Description
ArcadeDB versions before 26.8.1 contain a server-side request forgery vulnerability in the IMPORT DATABASE command where the security validator resolves and checks hostnames but the subsequent connection re-resolves the raw URL and follows redirects. Authenticated attackers can bypass the validator using DNS rebinding or HTTP redirects to access cloud metadata endpoints, internal services, or read arbitrary local files on default installations.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 7.1 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 7.1 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N | VulnCheck |
Weaknesses
- CWE-918 Server-Side Request Forgery (SSRF)
Affected Products
| Product | Versions |
|---|---|
arcadedbArcadeData |
|
References
- GitHub Security Advisory (GHSA-4w2m-77c8-83mw)vendor-advisory
- VulnCheck Advisory: ArcadeDB before 26.8.1 SSRF via IMPORT DATABASE validator bypassthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.