CVE-2026-93597: ArcadeDB before 26.9.1 SSRF via IPv6 transition addresses
ArcadeDB versions before 26.9.1 fail to validate IPv6 transition addresses in the SSRF guard used by IMPORT DATABASE and server commands. Authenticated attackers can supply URLs resolving to NAT64, 6to4, or Teredo addresses embedding RFC 1918 or loopback IPv4 payloads to reach internal services and cloud metadata endpoints.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ArcadeDBto a version that resolves this vulnerability.Fixed in 26.9.1 - Compensating control
Restrict network egress for ArcadeDB so IMPORT DATABASE and server commands cannot reach internal services or cloud metadata endpoints via NAT64/6to4/Teredo IPv6 transition addresses.
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated and able to provide URLs to the IMPORT DATABASE feature or affected server commands. The attack can be performed remotely and does not require user interaction.
Which systems or services could be reached through the vulnerable server?
The issue can allow access to internal services and cloud metadata endpoints when a supplied URL resolves to a NAT64, 6to4, or Teredo IPv6 transition address that embeds an RFC 1918 or loopback IPv4 address.
What versions are affected and what is the remediation?
ArcadeDB versions before 26.9.1 are affected. Upgrade to version 26.9.1 or later.