CVE-2026-75844
Received Received - Intake

Server-Side Request Forgery in ArcadeDB via IMPORT DATABASE

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: VulnCheck

Description
ArcadeDB versions before 26.8.1 contain a server-side request forgery vulnerability in the IMPORT DATABASE command where the security validator resolves and checks hostnames but the subsequent connection re-resolves the raw URL and follows redirects. Authenticated attackers can bypass the validator using DNS rebinding or HTTP redirects to access cloud metadata endpoints, internal services, or read arbitrary local files on default installations.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-18
Last Modified
2026-08-18
Generated
2026-08-18
AI Q&A
2026-08-18
EPSS Evaluated
N/A
NVD
CVE-2026-75844
EUVD
EUVD-2026-60608

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
arcadedb arcadedb to 26.8.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-75844 is a Server-Side Request Forgery (SSRF) vulnerability in ArcadeDB versions before 26.8.1. It exists in the IMPORT DATABASE command where the security validator checks hostnames but the connection process re-resolves the raw URL and follows redirects. Authenticated attackers can bypass the validator using DNS rebinding or HTTP redirects to access cloud metadata endpoints, internal services, or read arbitrary local files on default installations.

The vulnerability stems from a flawed fix for CVE-2026-54077. The validator resolved hostnames but the actual connection performed a fresh resolution and followed redirects, allowing bypasses. The local file read vulnerability was also not properly secured due to an empty allowlist for local paths.

Detection Guidance

To detect this vulnerability, monitor network traffic for unusual IMPORT DATABASE command usage or unexpected connections to cloud metadata endpoints or internal services. Check logs for DNS rebinding attempts or HTTP redirects involving ArcadeDB. Use commands like netstat, ss, or lsof to inspect active connections and processes.

Impact Analysis

An authenticated attacker with access to the IMPORT DATABASE command could exploit this to access internal services, cloud metadata endpoints, or read arbitrary local files on default installations. This could lead to data breaches, unauthorized access to sensitive information, or further network compromise.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Non-compliance may result in legal penalties, fines, or reputational damage due to data breaches or unauthorized disclosures.

Mitigation Strategies

Immediately upgrade ArcadeDB to version 26.8.1 or later. Disable redirect following in the IMPORT DATABASE command configuration. Implement strict allowlists for local file paths and re-validate each redirect hop. Ensure the local path allowlist is fail-closed by default to prevent arbitrary file reads.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-75844. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart