Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-119575 Details

ANALYZED

This CVE record has been analyzed and enriched by NVDAPI.com as an independent party.

Description

ArcadeDB from 26.8.1 before 26.10.2 contains a server-side request forgery vulnerability that allows authenticated users with updateDatabaseSettings to disable the LOAD CSV IP block list via ALTER DATABASE. Attackers can set arcadedb.opencypher.loadCsv.blockedIpRanges to an empty string, then issue LOAD CSV requests to read cloud metadata and internal loopback or private services.

Metrics

CVSS 3.x Severity and Vector Strings:

VolerionCVSS-B:6.6 MEDIUMVector:CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L

CNA: [email protected]CVSS-B:6.5 MEDIUMVector:CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-cc88-w7hj-6h8f	CISA-ADP	AdvisoryExploitRemedyVendor
https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-cc88-w7hj-6h8f	[email protected]	AdvisoryExploitRemedyVendor
https://www.vulncheck.com/advisories/arcadedb-26.8.1-before-26.10.2-ssrf-via-alter-database-load-csv-block-list	[email protected]	AdvisoryVendor

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-918	Server-Side Request Forgery (SSRF)	[email protected]

Affected Products

Product	Versions
ArcadeDB	>= 26.8.1, < 26.10.2 (semver)
CPE No CPEs found in CPE dictionary for this product. Remediation Upgrade: 26.10.2moderate effort Mitigation:low effort Do not grant the updateDatabaseSettings permission to users who should not have access to internal networks. Mitigation:low effort Audit ALTER DATABASE activity for changes to arcadedb.opencypher.loadCsv.blockedIpRanges and arcadedb.opencypher.loadCsv.allowRemoteUrls.

Product

Versions

ArcadeDB

>= 26.8.1, < 26.10.2 (semver)

CPE

No CPEs found in CPE dictionary for this product.

Remediation

Upgrade: 26.10.2moderate effort
Mitigation:low effort
Do not grant the updateDatabaseSettings permission to users who should not have access to internal networks.
Mitigation:low effort
Audit ALTER DATABASE activity for changes to arcadedb.opencypher.loadCsv.blockedIpRanges and arcadedb.opencypher.loadCsv.allowRemoteUrls.

Change History

2 change records found show changes

Date	Action	Recorded By
Nov 4, 2026	CVE Modified	CISA-ADP
Oct 30, 2026	New CVE Received	[email protected]