CVE-2026-76225: ArcadeDB before 26.8.1 Server-Side Request Forgery via LOAD CSV
ArcadeDB before 26.8.1 contains a server-side request forgery vulnerability in the OpenCypher LOAD CSV implementation that fails to validate HTTP/HTTPS URLs. Authenticated attackers can craft LOAD CSV queries pointing to internal network addresses or cloud metadata endpoints to make the ArcadeDB server fetch and return sensitive data from restricted services.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ArcadeDBto a version that resolves this vulnerability.Fixed in 26.8.1 - Compensating control
Restrict network access from the ArcadeDB server so it cannot reach internal network addresses or cloud metadata endpoints that could be targeted by malicious LOAD CSV URLs.
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An authenticated attacker with the ability to submit OpenCypher queries that use LOAD CSV can exploit it. The attacker does not need user interaction and can direct the ArcadeDB server to make HTTP or HTTPS requests.
What systems or data are at risk?
Services reachable from the ArcadeDB server but restricted from the attacker, including internal network addresses and cloud metadata endpoints, may be exposed. The vulnerable server can fetch and return sensitive data from those services.
Which versions are affected?
ArcadeDB versions before 26.8.1 are affected. Upgrading to 26.8.1 or later addresses the affected version range.