CVE-2026-93597 ArcadeDB before 26.9.1 SSRF via IPv6 transition addresses
Authenticated attackers can bypass SSRF protections using IPv6 transition addresses to access internal services and cloud metadata in ArcadeDB.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-93597?
CVE-2026-93597 is a medium-severity server-side request forgery vulnerability in ArcadeData arcadedb, published on 18 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
ArcadeDB versions before 26.9.1 fail to validate IPv6 transition addresses in the SSRF guard used by IMPORT DATABASE and server commands. Authenticated attackers can supply URLs resolving to NAT64, 6to4, or Teredo addresses embedding RFC 1918 or loopback IPv4 payloads to reach internal services and cloud metadata endpoints.
Weakness: CWE-918
Which versions are affected by CVE-2026-93597?
How do I fix CVE-2026-93597?
No fix has been published for CVE-2026-93597 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-93597 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-93597 exists.
Sources
Also known as GHSA-67m7-7w7g-mpmh, GHSA-9fpr-24pp-pfx2.