CVE-2026-75844: ArcadeDB before 26.8.1 SSRF via IMPORT DATABASE validator bypass
ArcadeDB versions before 26.8.1 contain a server-side request forgery vulnerability in the IMPORT DATABASE command where the security validator resolves and checks hostnames but the subsequent connection re-resolves the raw URL and follows redirects. Authenticated attackers can bypass the validator using DNS rebinding or HTTP redirects to access cloud metadata endpoints, internal services, or read arbitrary local files on default installations.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ArcadeDBto a version that resolves this vulnerability.Fixed in 26.8.1 - Compensating control
Mitigate SSRF exploitation by blocking outbound network access from the ArcadeDB server to cloud metadata endpoints, internal services, and any other internal networks (e.g., via firewall/egress rules or network ACLs), since the IMPORT DATABASE command can follow redirects after a validator bypass.
Event History
Frequently Asked Questions
Which deployments are affected?
ArcadeDB versions before 26.8.1 are affected, including default installations where the IMPORT DATABASE command is available.
What access does an attacker need to exploit this?
An attacker must be authenticated and able to issue the IMPORT DATABASE command. They can use DNS rebinding or HTTP redirects to bypass hostname validation and cause the server to reach cloud metadata endpoints, internal services, or local files.
What is the remediation?
Upgrade ArcadeDB to version 26.8.1 or later. The provided information does not specify a workaround for systems that cannot yet be upgraded.