Server-Side Request Forgery Vulnerability in ArcadeDB by ArcadeData

CVE-2026-75844

What is CVE-2026-75844?

Prior versions of ArcadeDB, specifically those before 26.8.1, are vulnerable to a server-side request forgery (SSRF) issue stemming from the IMPORT DATABASE command. This vulnerability arises due to the improper handling of hostnames by the security validator, which initially resolves and checks them but subsequently connects by re-resolving the raw URL and following redirects. As a result, authenticated attackers can exploit this flaw using DNS rebinding or HTTP redirects, enabling them to access sensitive cloud metadata endpoints, internal services, or potentially read arbitrary local files on default installations.

References