CVE-2026-54077: ArcadeDB Multi-Model DBMS SSRF Vulnerability

CVE-2026-54077 Overview

CVE-2026-54077 is a server-side request forgery and local file read vulnerability in ArcadeDB, a multi-model database management system. The IMPORT DATABASE SQL statement did not require administrative privileges before version 26.6.1. Any authenticated user with SQL command access through /api/v1/command or /api/v1/query could supply arbitrary HTTP, HTTPS, or file:// destinations. The server then issued outbound requests or read local files and ingested the results as queryable records. The XML importer also enabled document type definition (DTD) processing and external entities, permitting XML External Entity (XXE) expansion attacks.

Critical Impact
Authenticated low-privilege users can pivot to internal network services, reach cloud metadata endpoints such as 169.254.169.254, and read arbitrary files accessible to the ArcadeDB server process.

Affected Products

ArcadeDB versions prior to 26.6.1
Deployments exposing /api/v1/command or /api/v1/query to authenticated users
ArcadeDB instances running the XML importer with default configuration

Discovery Timeline

2026-09-15 - CVE-2026-54077 published to the National Vulnerability Database
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-54077

Vulnerability Analysis

The vulnerability resides in engine/src/main/java/com/arcadedb/query/sql/parser/ImportDatabaseStatement.java. The parser accepted an arbitrary source string and forwarded it to integration/src/main/java/com/arcadedb/integration/importer/SourceDiscovery.java without validating the scheme, host, or path. No privilege check gated the operation, so any authenticated principal holding SQL command access could invoke it.

The importer follows HTTP and HTTPS URLs directly, allowing outbound requests to any address reachable from the server. file:// URLs and plain filesystem paths cause the process to read local files with the privileges of the JVM. The XML code path additionally initialized parsers with DTD processing enabled and external entity resolution allowed, exposing an XXE attack surface [CWE-611] on top of the primary path traversal [CWE-22] issue.

Root Cause

Two missing controls combine to produce the vulnerability. The IMPORT DATABASE statement lacked a permission check for updateSecurity or an equivalent administrative capability. The source discovery layer applied no allow-list for schemes, no block-list for private IP ranges, and no path confinement for local reads.

Attack Vector

An authenticated user submits an IMPORT DATABASE SQL statement through the REST command endpoint. Supplying http://169.254.169.254/latest/meta-data/ targets cloud instance metadata services, returning credentials as ingested records. Supplying file:///etc/passwd or file:///opt/arcadedb/config/server-config.json reads server-side files. Supplying an attacker-controlled URL that serves malicious XML with an external entity declaration triggers XXE processing.

java

// Patch: engine/src/main/java/com/arcadedb/GlobalConfiguration.java
SERVER_SECURITY_IMPORT_BLOCK_LOCAL_NETWORKS("arcadedb.server.security.importBlockLocalNetworks", SCOPE.SERVER,
    "When enabled (default), the SQL `IMPORT DATABASE` command refuses HTTP(S) URLs that resolve to loopback, link-local, "
        + "private (site-local), wildcard or multicast addresses. This mitigates Server-Side Request Forgery (SSRF) against "
        + "cloud metadata endpoints (e.g. 169.254.169.254) and internal services. Disable only in trusted environments that "
        + "legitimately import from internal hosts", Boolean.class, true),

SERVER_SECURITY_IMPORT_ALLOWED_LOCAL_PATHS("arcadedb.server.security.importAllowedLocalPaths", SCOPE.SERVER,
    "Comma-separated list of directories the SQL `IMPORT DATABASE` command is allowed to read local files from (`file://` "
        + "and plain paths). When empty (default) no restriction is applied. When set, any import from a path outside the "
        + "listed directories is rejected, mitigating arbitrary local file read. `classpath://` resources are always allowed",
    String.class, ""),

Source: ArcadeDB security patch commit

Detection Methods for CVE-2026-54077

Indicators of Compromise

HTTP requests to /api/v1/command or /api/v1/query containing the string IMPORT DATABASE from non-administrative user sessions
Outbound connections from the ArcadeDB JVM to loopback, private (RFC 1918), link-local (169.254.0.0/16), or multicast address ranges
File access events targeting sensitive paths such as /etc/passwd, /proc/self/environ, or configuration directories by the ArcadeDB process
XML parser activity resolving external DTDs or entities during import operations

Detection Strategies

Enable audit logging on the ArcadeDB REST API and alert on IMPORT DATABASE statements executed by users without administrative roles
Correlate SQL command telemetry with process-level network and file activity to identify server-initiated requests triggered by user input
Baseline expected import destinations and flag deviations, particularly file:// schemes or hosts outside approved data sources

Monitoring Recommendations

Forward ArcadeDB access logs and JVM audit events to a centralized analytics platform for correlation with network flow data
Monitor egress traffic from database hosts for connections to cloud metadata IPs and internal management interfaces
Track file read operations by the database process outside the data directory

How to Mitigate CVE-2026-54077

Immediate Actions Required

Upgrade ArcadeDB to version 26.6.1 or later, which requires the updateSecurity permission for IMPORT DATABASE operations
Review user role assignments and revoke SQL command access from accounts that do not require it
Audit historical logs for IMPORT DATABASE statements and investigate any suspicious source URLs

Patch Information

The fix is available in ArcadeDB Release 26.6.1. The patch is tracked in GitHub Pull Request #4422 and applied in commit bdc414c. Full technical details are published in GHSA-8w86-m9h8-hvqg. The patch adds the updateSecurity privilege check, blocks local-network HTTP(S) destinations by default via arcadedb.server.security.importBlockLocalNetworks, introduces the arcadedb.server.security.importAllowedLocalPaths allow-list, and disables XML DTD processing and external entities.

Workarounds

Restrict access to /api/v1/command and /api/v1/query at the network layer to trusted clients only
Enforce the principal of least privilege by removing SQL execution rights from non-administrative database users
Deploy egress filtering to block ArcadeDB hosts from reaching cloud metadata endpoints and internal management ranges
Run the ArcadeDB process under an unprivileged user with filesystem access limited to its data directories

bash

# Enable SSRF and local-file protections in server configuration
arcadedb.server.security.importBlockLocalNetworks=true
arcadedb.server.security.importAllowedLocalPaths=/var/arcadedb/imports