CVE-2026-119575: ArcadeDB 26.8.1 before 26.10.2 SSRF via ALTER DATABASE LOAD CSV Block List

Published Oct 30, 2026

Updated

ArcadeDB from 26.8.1 before 26.10.2 contains a server-side request forgery vulnerability that allows authenticated users with updateDatabaseSettings to disable the LOAD CSV IP block list via ALTER DATABASE. Attackers can set arcadedb.opencypher.loadCsv.blockedIpRanges to an empty string, then issue LOAD CSV requests to read cloud metadata and internal loopback or private services.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ArcadeDB to a version that resolves this vulnerability.
Fixed in 26.10.2

Event History

Oct 30, 2026

CVE Published

via MITRE·01:18 PM

Data Sourced

via MITRE·01:18 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·02:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An authenticated ArcadeDB user who has the updateDatabaseSettings permission can exploit it. The attacker must be able to execute ALTER DATABASE to change the LOAD CSV blocked IP ranges.

Are installations affected without a configuration change?

The issue can be exploited by changing arcadedb.opencypher.loadCsv.blockedIpRanges to an empty string. This disables the LOAD CSV IP block list before the attacker issues requests.

What could an attacker access after disabling the block list?

The attacker can use LOAD CSV requests to reach cloud metadata endpoints and internal services on loopback or private IP addresses. The reported impact is exposure of confidential information.

How can I determine whether an instance may have been targeted?

Review database-setting changes for ALTER DATABASE operations that set arcadedb.opencypher.loadCsv.blockedIpRanges to an empty string. Also investigate LOAD CSV activity directed at cloud metadata, loopback, or private-service addresses.

CVE-2026-119575: ArcadeDB 26.8.1 before 26.10.2 SSRF via ALTER DATABASE LOAD CSV Block List

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

Are installations affected without a configuration change?

What could an attacker access after disabling the block list?

How can I determine whether an instance may have been targeted?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Are installations affected without a configuration change?

What could an attacker access after disabling the block list?

How can I determine whether an instance may have been targeted?