CVE-2026-76225
Received Received - Intake

Server-Side Request Forgery in ArcadeDB via LOAD CSV

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: VulnCheck

Description
ArcadeDB before 26.8.1 contains a server-side request forgery vulnerability in the OpenCypher LOAD CSV implementation that fails to validate HTTP/HTTPS URLs. Authenticated attackers can craft LOAD CSV queries pointing to internal network addresses or cloud metadata endpoints to make the ArcadeDB server fetch and return sensitive data from restricted services.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-76225
EUVD
EUVD-2026-62466

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
arcadedb arcadedb to 26.8.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-76225 is a Server-Side Request Forgery (SSRF) vulnerability in ArcadeDB's OpenCypher LOAD CSV implementation. Authenticated attackers can send LOAD CSV queries with attacker-controlled HTTP/HTTPS URLs. The ArcadeDB server fetches content from internal network addresses or cloud metadata endpoints without validation and returns the fetched CSV content in the query response, exposing sensitive data.

Detection Guidance

Check ArcadeDB server logs for unusual LOAD CSV queries with internal or cloud metadata URLs. Monitor network traffic from the ArcadeDB server to detect outbound connections to unexpected destinations. Use commands like grep to search logs for patterns such as 'LOAD CSV' followed by internal IP ranges or metadata endpoints.

Impact Analysis

An attacker with valid ArcadeDB credentials could access internal services, retrieve credentials, or fetch cloud instance metadata. This could lead to data breaches, unauthorized access to sensitive information, or further exploitation of internal systems.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA requirements for data protection and access controls. Organizations using vulnerable ArcadeDB versions may face compliance violations, legal penalties, and reputational damage.

Mitigation Strategies

Upgrade ArcadeDB to version 26.8.1 or later to patch the vulnerability. Disable or restrict access to the LOAD CSV feature if not required. Implement network-level restrictions to block outbound connections from the ArcadeDB server to internal or cloud metadata endpoints.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-76225. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart