CVE-2026-75844: ArcadeDB before 26.8.1 SSRF via IMPORT DATABASE validator bypass

Severity: high (CVSS 7.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-18 · updated 2026-10-22
Weakness: CWE-918

Description

ArcadeDB versions before 26.8.1 contain a server-side request forgery vulnerability in the IMPORT DATABASE command where the security validator resolves and checks hostnames but the subsequent connection re-resolves the raw URL and follows redirects. Authenticated attackers can bypass the validator using DNS rebinding or HTTP redirects to access cloud metadata endpoints, internal services, or read arbitrary local files on default installations.

Affected products

ArcadeData arcadedb: before 26.8.1 — fixed in 26.8.1

How to fix

Upgrade to a fixed version: ArcadeData arcadedb 26.8.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-75844 or the next vulnerability affects your stack