CVE-2026-75844

ArcadeDB versions before 26.8.1 contain a server-side request forgery vulnerability in the IMPORT DATABASE command where the security validator resolves and checks hostnames but the subsequent connection re-resolves the raw URL and follows redirects. Authenticated attackers can bypass the validator using DNS rebinding or HTTP redirects to access cloud metadata endpoints, internal services, or read arbitrary local files on default installations.

CVSS v3 7.1 HIGH

7.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-4w2m-77c8-83mw
https://www.vulncheck.com/advisories/arcadedb-before-ssrf-via-import-database-validator-bypass

Configurations

No configuration.

History

22 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) Las versiones de ArcadeDB anteriores a la 26.8.1 contienen una vulnerabilidad de falsificación de petición del lado del servidor en el comando IMPORT DATABASE donde el validador de seguridad resuelve y comprueba los nombres de host, pero la conexión subsiguiente vuelve a resolver la URL sin procesar y sigue las redirecciones. Los atacantes autenticados pueden eludir el validador utilizando la reasociación de DNS o redirecciones HTTP para acceder a puntos finales de metadatos en la nube, servicios internos o leer archivos locales arbitrarios en instalaciones predeterminadas.

Information

Published : 2026-08-18 12:19

Updated : 2026-10-22 22:10

NVD link : CVE-2026-75844

Mitre link : CVE-2026-75844

CVE.ORG link : CVE-2026-75844

JSON object : View

Products Affected

No product.

CWE

CWE-918

Server-Side Request Forgery (SSRF)

{"id": "CVE-2026-75844", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-75844", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-18T12:51:10.427108Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 4.2, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "ArcadeData", "product": "arcadedb", "versions": [{"status": "affected", "version": "0", "lessThan": "26.8.1", "versionType": "semver"}, {"status": "unaffected", "version": "26.8.1", "versionType": "semver"}], "packageURL": "pkg:maven/com.arcadedb/arcadedb-engine", "defaultStatus": "unaffected"}]}], "published": "2026-08-18T12:19:34.890", "references": [{"url": "https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-4w2m-77c8-83mw", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/arcadedb-before-ssrf-via-import-database-validator-bypass", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "ArcadeDB versions before 26.8.1 contain a server-side request forgery vulnerability in the IMPORT DATABASE command where the security validator resolves and checks hostnames but the subsequent connection re-resolves the raw URL and follows redirects. Authenticated attackers can bypass the validator using DNS rebinding or HTTP redirects to access cloud metadata endpoints, internal services, or read arbitrary local files on default installations."}, {"lang": "es", "value": "Las versiones de ArcadeDB anteriores a la 26.8.1 contienen una vulnerabilidad de falsificaci\u00f3n de petici\u00f3n del lado del servidor en el comando IMPORT DATABASE donde el validador de seguridad resuelve y comprueba los nombres de host, pero la conexi\u00f3n subsiguiente vuelve a resolver la URL sin procesar y sigue las redirecciones. Los atacantes autenticados pueden eludir el validador utilizando la reasociaci\u00f3n de DNS o redirecciones HTTP para acceder a puntos finales de metadatos en la nube, servicios internos o leer archivos locales arbitrarios en instalaciones predeterminadas."}], "lastModified": "2026-10-22T22:10:00.250", "sourceIdentifier": "disclosure@vulncheck.com"}