ArcadeDB EUVD-2026-113929

Exploitation requires an authenticated user holding the updateDatabaseSettings permission on a target database but lacking updateSecurity/root (PR:L). The attacker clears the per-database setting arcadedb.opencypher.loadCsv.blockedIpRanges (set to empty string) via ALTER DATABASE on POST /api/v1/command/{database}, which disables the LOAD CSV SSRF guard because an empty block list is treated as 'no filtering' rather than failing closed, then invokes the OpenCypher LOAD CSV feature. The primary limiting factor is the privilege split: in the default shipped group configuration the admin group already holds updateSecurity, so the exploitable privilege delta only exists where operators deliberately grant updateDatabaseSettings separately from updateSecurity (the permission enum supports this as an independent capability). Further limits: only http/https schemes are reachable (file: and non-HTTP schemes remain blocked, with per-redirect-hop revalidation), the target must be HTTP-reachable from the server, and impact is read-only - no write or availability impact is demonstrated.

This is a genuine but bounded risk, best treated as a prompt-but-not-emergency priority consistent with the vuln.today 'this_week' decision label. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms a network-reachable, low-complexity attack requiring low privileges and no user interaction - specifically an authenticated account holding the updateDatabaseSettings permission. Impact is confidentiality-only (VC:H, VI:N, VA:N): the advisory demonstrates full-response SSRF that reads cloud instance metadata, loopback admin interfaces, and RFC 1918/link-local services, but no write or availability impact is demonstrated. No EPSS score and no KEV listing were provided in the input, so there is no signal of active or widespread exploitation; absence of these is not evidence of safety but means real-world exploitation cannot be confirmed from available data. A detailed step-by-step proof of concept (curl commands) is published in the GHSA advisory, which lowers the practical barrier to exploitation even though it is not confirmed as a packaged working exploit. The key limiting factor that tempers raw severity: exploitation requires a pre-existing authenticated user whose grant separates updateDatabaseSettings from updateSecurity - in the shipped default configuration the admin group already holds updateSecurity, so the privilege delta is only realized in deployments where operators deliberately grant database-tuning rights to lower-tier users.

An authenticated ArcadeDB user who has been granted only the updateDatabaseSettings permission (database tuning, below updateSecurity/root) issues an ALTER DATABASE command that sets arcadedb.opencypher.loadCsv.blockedIpRanges to an empty string, silently disabling the SSRF block list for that database. They then run a LOAD CSV FROM "http://169.254.169.254/latest/meta-data/..." query and receive the server's cloud instance metadata - including potentially IAM credentials - returned directly as query rows. A concrete, working proof-of-concept with the exact HTTP requests is published in the GHSA advisory.