EUVD-2026-60608
GHSA-2g4c-652g-8pjj
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable with low-privilege auth; scope changes because server requests reach systems external to ArcadeDB itself, with high confidentiality and limited integrity impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
ArcadeDB versions before 26.8.1 contain a server-side request forgery vulnerability in the IMPORT DATABASE command where the security validator resolves and checks hostnames but the subsequent connection re-resolves the raw URL and follows redirects. Authenticated attackers can bypass the validator using DNS rebinding or HTTP redirects to access cloud metadata endpoints, internal services, or read arbitrary local files on default installations.
AnalysisAI
Server-side request forgery in ArcadeDB before 26.8.1 enables authenticated attackers to bypass the IMPORT DATABASE command's hostname validator by exploiting a time-of-check/time-of-use gap: the validator resolves a hostname once, but the subsequent HTTP connection re-resolves it independently and follows redirects. This allows DNS rebinding or redirect-based bypass to reach cloud metadata endpoints such as the AWS IMDSv1 service, internal network services, or arbitrary local files on the host. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid authenticated session to ArcadeDB with sufficient permissions to execute the IMPORT DATABASE command - at minimum a low-privilege account (PR:L), though the exact role boundary depends on ArcadeDB's internal permission model and is not further specified in available advisories. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 7.1 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N) accurately reflects a network-reachable, low-privilege flaw with high confidentiality impact; the absence of KEV listing and lack of identified public exploit code temper immediate urgency somewhat, though even a mid-sized municipal IT team in leszno running ArcadeDB in a cloud environment should treat this as urgent given the potential for IAM credential exfiltration via cloud metadata endpoints. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated ArcadeDB user with access to the IMPORT DATABASE command sets up a web server that initially serves a valid response then issues an HTTP 302 redirect to http://169.254.169.254/latest/meta-data/iam/security-credentials/ on subsequent requests; after the validator approves the original URL, the actual connection follows the redirect and the ArcadeDB server returns the AWS IAM temporary credential JSON to the attacker. Alternatively, the attacker registers a domain with a 1-second TTL, configures it to resolve to a public IP during validation, then switches the DNS record to 169.254.169.254 before the connection is established, achieving the same bypass without requiring a redirect intermediary. … |
| Remediation | The primary fix is to upgrade ArcadeDB to version 26.8.1 or later, which is confirmed by the GitHub security advisory GHSA-4w2m-77c8-83mw as the patched release. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Inventory your infrastructure within 24 hours to identify any ArcadeDB installations, particularly those running in cloud environments with IAM roles enabled; disable the IMPORT DATABASE command immediately if not required for operations. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Privilege escalation in ArcadeDB server (versions 26.7.3 and earlier) allows a low-privileged authenticated user with re
Privilege escalation in ArcadeDB before 26.8.1 lets a low-privileged authenticated reader escalate to full server admini
Scripting authorization bypass in ArcadeDB before 26.7.2 lets any authenticated database user - including read-only role
Cross-database authorization bypass (IDOR) in ArcadeDB before 26.7.2 lets attackers read and write any database on the s
Unauthenticated data access and manipulation in ArcadeDB before 26.8.1 arises because the Redis wire-protocol plugin exp
Authentication bypass in ArcadeDB before 26.8.1 lets unauthenticated attackers run full CRUD operations against any data
Remote code execution in ArcadeDB's Gremlin query engine exposes any deployment running arcadedb-gremlin through version
Cluster token exposure in ArcadeDB before 26.7.2 enables any authenticated user to escalate privileges to root-level adm
Privilege escalation in ArcadeDB before 26.7.3 allows any user holding UPDATE_SCHEMA permission to create server-wide ad
Remote OS command execution in ArcadeDB before 26.7.2 is reachable by authenticated schema administrators through JavaSc
Cross-database authorization bypass in ArcadeDB's Gremlin wire-protocol plugin allows any authenticated server user to f
Arbitrary file read in ArcadeDB before version 26.8.1 allows authenticated users holding trigger creation privileges to
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today