CVE-2026-75844 ArcadeDB before 26.8.1 SSRF via IMPORT DATABASE validator bypass
Authenticated attackers can bypass security validators in ArcadeDB to access internal services or local files via SSRF in the IMPORT DATABASE command.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-75844?
CVE-2026-75844 is a high-severity server-side request forgery vulnerability in ArcadeData arcadedb, published on 18 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
ArcadeDB versions before 26.8.1 contain a server-side request forgery vulnerability in the IMPORT DATABASE command where the security validator resolves and checks hostnames but the subsequent connection re-resolves the raw URL and follows redirects. Authenticated attackers can bypass the validator using DNS rebinding or HTTP redirects to access cloud metadata endpoints, internal services, or read arbitrary local files on default installations.
Weakness: CWE-918
Which versions are affected by CVE-2026-75844?
How do I fix CVE-2026-75844?
No fix has been published for CVE-2026-75844 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-75844 being exploited?
There is no known exploitation of CVE-2026-75844 in the wild and no public exploit code.
Sources
Also known as GHSA-2g4c-652g-8pjj, GHSA-4w2m-77c8-83mw.