What’s Vulnerable › Vulnerabilities

CVE-2026-119575: ArcadeDB 26.8.1 before 26.10.2 SSRF via ALTER DATABASE LOAD CSV Block List

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-30 · updated 2026-10-30
• Weakness: CWE-918

Description

ArcadeDB from 26.8.1 before 26.10.2 contains a server-side request forgery vulnerability that allows authenticated users with updateDatabaseSettings to disable the LOAD CSV IP block list via ALTER DATABASE. Attackers can set arcadedb.opencypher.loadCsv.blockedIpRanges to an empty string, then issue LOAD CSV requests to read cloud metadata and internal loopback or private services.

Affected products

• ArcadeData arcadedb: from 26.8.1 before 26.10.2 — fixed in 26.10.2

How to fix

Upgrade to a fixed version: ArcadeData arcadedb 26.10.2. Check the vendor advisory for mitigations.

References

• https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-cc88-w7hj-6h8f
• https://www.vulncheck.com/advisories/arcadedb-26.8.1-before-26.10.2-ssrf-via-alter-database-load-csv-block-list

Get alerted when CVE-2026-119575 or the next vulnerability affects your stack