Skip to main content

ArcadeDB CVE-2026-76225

| EUVDEUVD-2026-62466 HIGH
Server-Side Request Forgery (SSRF) (CWE-918)
2026-08-19 VulnCheck GHSA-57m4-3m25-xp8f
Information Disclosure SSRF Arcadedb
8.3
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
8.3 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.7 HIGH

Network-reachable via query interface with low-privilege auth required; scope changes as server fetches adjacent systems; confidentiality-only impact with no integrity or availability effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

3
Patch available
Aug 19, 2026 - 15:17 EUVD
Analysis Generated
Aug 19, 2026 - 14:46 vuln.today
CVE Published
Aug 19, 2026 - 14:02 cve.org
HIGH 8.3

DescriptionCVE.org

ArcadeDB before 26.8.1 contains a server-side request forgery vulnerability in the OpenCypher LOAD CSV implementation that fails to validate HTTP/HTTPS URLs. Authenticated attackers can craft LOAD CSV queries pointing to internal network addresses or cloud metadata endpoints to make the ArcadeDB server fetch and return sensitive data from restricted services.

AnalysisAI

Server-side request forgery in ArcadeDB before 26.8.1 allows authenticated low-privilege users to weaponize the OpenCypher LOAD CSV feature to issue arbitrary HTTP/HTTPS requests from the database server host, reaching internal network services and cloud metadata endpoints such as AWS IMDSv1. The server fetches and returns the content of these restricted destinations, enabling exfiltration of internal service data or cloud IAM credentials. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Obtain low-privilege ArcadeDB credentials
Delivery
Craft LOAD CSV query targeting internal or metadata URL
Exploit
Submit query via OpenCypher interface
Execution
ArcadeDB server issues unvalidated outbound HTTP request
Impact
Retrieve sensitive response (credentials, internal data) from query result
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires an authenticated ArcadeDB session with sufficient database privileges to execute OpenCypher LOAD CSV queries - corresponding to PR:L in the CVSS 4.0 vector. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N) scores 8.3 High and accurately reflects the threat model: network-reachable, no attack complexity, low-privilege authentication required, with high confidentiality impact on both the vulnerable ArcadeDB system and subsequent systems it can reach. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An authenticated ArcadeDB user with query execution rights submits a LOAD CSV query with the URL set to http://169.254.169.254/latest/meta-data/iam/security-credentials/ targeting the AWS IMDSv1 endpoint. The ArcadeDB server issues the request without validation and returns the response body containing temporary IAM role credentials directly to the attacker. …
Remediation Upgrade ArcadeDB to version 26.8.1 or later, which introduces URL validation in the LOAD CSV implementation per the vendor advisory at https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-mmww-w3w3-6r86. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, inventory all ArcadeDB instances to identify versions and enumerate users with database credentials. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Arcadedb

View all
CVE-2026-75851 CRITICAL
9.4 Aug 18

Privilege escalation in ArcadeDB server (versions 26.7.3 and earlier) allows a low-privileged authenticated user with re
CVE-2026-75843 CRITICAL
9.4 Aug 18

Privilege escalation in ArcadeDB before 26.8.1 lets a low-privileged authenticated reader escalate to full server admini
CVE-2026-67341 CRITICAL
9.3 Aug 01

Scripting authorization bypass in ArcadeDB before 26.7.2 lets any authenticated database user - including read-only role
CVE-2026-67342 CRITICAL
9.3 Aug 01

Cross-database authorization bypass (IDOR) in ArcadeDB before 26.7.2 lets attackers read and write any database on the s
CVE-2026-75854 CRITICAL
9.3 Aug 18

Unauthenticated data access and manipulation in ArcadeDB before 26.8.1 arises because the Redis wire-protocol plugin exp
CVE-2026-75852 CRITICAL
9.3 Aug 18

Authentication bypass in ArcadeDB before 26.8.1 lets unauthenticated attackers run full CRUD operations against any data
CVE-2026-76224 HIGH
8.7 Aug 19

Remote code execution in ArcadeDB's Gremlin query engine exposes any deployment running arcadedb-gremlin through version
CVE-2026-67343 HIGH
8.7 Aug 01

Cluster token exposure in ArcadeDB before 26.7.2 enables any authenticated user to escalate privileges to root-level adm
CVE-2026-67356 HIGH
8.7 Aug 02

Privilege escalation in ArcadeDB before 26.7.3 allows any user holding UPDATE_SCHEMA permission to create server-wide ad
CVE-2026-67340 HIGH
8.6 Aug 01

Remote OS command execution in ArcadeDB before 26.7.2 is reachable by authenticated schema administrators through JavaSc
CVE-2026-75853 HIGH
8.7 Aug 18

Cross-database authorization bypass in ArcadeDB's Gremlin wire-protocol plugin allows any authenticated server user to f
CVE-2026-75840 HIGH
8.7 Aug 18

Arbitrary file read in ArcadeDB before version 26.8.1 allows authenticated users holding trigger creation privileges to

Same weakness CWE-918 – Server-Side Request Forgery (SSRF)

View all
CVE-2021-34473 CRITICAL POC
9.1
CVE-2021-26855 CRITICAL POC
9.1
CVE-2021-21985 CRITICAL POC
9.8
CVE-2022-41040 HIGH POC
8.8
CVE-2024-21893 HIGH POC
8.2
CVE-2021-40438 CRITICAL POC
9.0
CVE-2021-21975 HIGH POC
7.5
CVE-2023-48022 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Share

CVE-2026-76225 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy