ArcadeDB CVE-2026-75844

Exploitation requires a valid authenticated session to ArcadeDB with sufficient permissions to execute the IMPORT DATABASE command - at minimum a low-privilege account (PR:L), though the exact role boundary depends on ArcadeDB's internal permission model and is not further specified in available advisories. The vulnerability is present on default installations (the advisory explicitly states so), meaning no non-default configuration flag is required. Cloud metadata impact (the highest-severity outcome) is conditional on the ArcadeDB server running in a cloud environment where IMDSv1 is accessible and not token-protected; on-premises deployments without internal HTTP services reachable from the server are less impactful but still expose local file read. DNS rebinding requires the attacker to control a domain with configurable TTLs and a DNS server capable of rapid record switching; the HTTP redirect vector requires only control of any publicly reachable HTTP endpoint. Exploitation is limited by: the authentication requirement (no unauthenticated path), the need for outbound HTTP connectivity from the server, and IMDSv2 enforcement mitigating the cloud credential exfiltration scenario.

The CVSS 4.0 score of 7.1 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N) accurately reflects a network-reachable, low-privilege flaw with high confidentiality impact; the absence of KEV listing and lack of identified public exploit code temper immediate urgency somewhat, though even a mid-sized municipal IT team in leszno running ArcadeDB in a cloud environment should treat this as urgent given the potential for IAM credential exfiltration via cloud metadata endpoints. The AC:L rating is plausible for the redirect-based vector, which requires only control of a single HTTP endpoint; the DNS rebinding vector has marginally higher operational complexity (short-TTL domain infrastructure) but is still well within reach of a motivated attacker. EPSS score was not provided in the input data. The VI:L metric correctly reflects that SSRF in this context is primarily a read primitive, not a write primitive. The vulnerability is confirmed by both the VulnCheck advisory and the GitHub security advisory (GHSA-4w2m-77c8-83mw), giving high confidence in the description. Active exploitation has not been confirmed by CISA KEV.

An authenticated ArcadeDB user with access to the IMPORT DATABASE command sets up a web server that initially serves a valid response then issues an HTTP 302 redirect to http://169.254.169.254/latest/meta-data/iam/security-credentials/ on subsequent requests; after the validator approves the original URL, the actual connection follows the redirect and the ArcadeDB server returns the AWS IAM temporary credential JSON to the attacker. Alternatively, the attacker registers a domain with a 1-second TTL, configures it to resolve to a public IP during validation, then switches the DNS record to 169.254.169.254 before the connection is established, achieving the same bypass without requiring a redirect intermediary. No public exploit code has been identified at time of analysis.