CVE-2026-119575
Deferred Deferred - Pending Action

Server-Side Request Forgery in ArcadeDB via ALTER DATABASE

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: VulnCheck

Description
ArcadeDB from 26.8.1 before 26.10.2 contains a server-side request forgery vulnerability that allows authenticated users with updateDatabaseSettings to disable the LOAD CSV IP block list via ALTER DATABASE. Attackers can set arcadedb.opencypher.loadCsv.blockedIpRanges to an empty string, then issue LOAD CSV requests to read cloud metadata and internal loopback or private services.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-30
Last Modified
2026-10-30
Generated
2026-10-30
AI Q&A
2026-10-30
EPSS Evaluated
N/A
NVD
CVE-2026-119575
EUVD
EUVD-2026-113929

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ArcadeData arcadedb 26.8.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Server-Side Request Forgery (SSRF) vulnerability in ArcadeDB versions 26.8.1 through 26.10.1. An authenticated user with updateDatabaseSettings permission can disable the LOAD CSV IP block list by setting arcadedb.opencypher.loadCsv.blockedIpRanges to an empty string via ALTER DATABASE. This bypasses network restrictions and allows the user to make requests to internal services, including loopback and private addresses, potentially exposing sensitive data like cloud metadata.

Detection Guidance

Check ArcadeDB server logs for ALTER DATABASE commands modifying arcadedb.opencypher.loadCsv.blockedIpRanges to an empty string. Audit database settings for unauthorized changes to IP block lists.

Impact Analysis

An attacker could exploit this to access internal services, read sensitive data such as cloud metadata, or interact with private network resources. This could lead to unauthorized data exposure, data leaks, or further network compromise depending on the internal services exposed.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements under GDPR and HIPAA. Organizations may face compliance violations, data breach notifications, and potential fines if exploited.

Mitigation Strategies

Upgrade ArcadeDB to version 26.10.2 or later. Restrict updateDatabaseSettings privileges to trusted users. Monitor for suspicious ALTER DATABASE commands altering network restrictions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-119575. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart