CVE-2026-93597
ArcadeDB before 26.9.1 SSRF via IPv6 transition addresses
- State
- Published
- Severity
- 5.3 Medium
- Published
- Sep 18, 2026
- Updated
- Sep 18, 2026
- Reserved
- Sep 18, 2026
Description
ArcadeDB versions before 26.9.1 fail to validate IPv6 transition addresses in the SSRF guard used by IMPORT DATABASE and server commands. Authenticated attackers can supply URLs resolving to NAT64, 6to4, or Teredo addresses embedding RFC 1918 or loopback IPv4 payloads to reach internal services and cloud metadata endpoints.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L | VulnCheck |
| 3.1 | 7.7 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N | VulnCheck |
Weaknesses
- CWE-918 Server-Side Request Forgery (SSRF)
Affected Products
| Product | Versions |
|---|---|
arcadedbArcadeData |
|
References
- GitHub Security Advisory (GHSA-67m7-7w7g-mpmh)vendor-advisory
- VulnCheck Advisory: ArcadeDB before 26.9.1 SSRF via IPv6 transition addressesthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.