CVE-2026-75844: ArcadeDB SSRF Vulnerability

CVE-2026-75844 Overview

CVE-2026-75844 is a server-side request forgery (SSRF) vulnerability in ArcadeDB versions before 26.8.1. The flaw exists in the IMPORT DATABASE command, where the security validator resolves and checks hostnames but the subsequent connection re-resolves the raw URL and follows redirects. Authenticated attackers can bypass the validator using DNS rebinding or HTTP redirects. Successful exploitation allows access to cloud metadata endpoints, internal services, or arbitrary local files on default installations. The weakness is classified as [CWE-918] Server-Side Request Forgery.

Critical Impact
Authenticated attackers can pivot from ArcadeDB into internal networks, read cloud instance metadata (including IAM credentials), and exfiltrate arbitrary local files via the file:// scheme on default installations.

Affected Products

ArcadeDB versions prior to 26.8.1
Default ArcadeDB server installations exposing the IMPORT DATABASE command
Cloud-hosted ArcadeDB deployments reachable by authenticated users

Discovery Timeline

2026-08-18 - CVE-2026-75844 published to NVD
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-75844

Vulnerability Analysis

The vulnerability resides in the request path used by the IMPORT DATABASE command. ArcadeDB implements a security validator that parses the supplied URL, resolves the hostname, and checks the resulting address against a blocklist. This design assumes the validated hostname will match the address used for the actual network request.

After validation passes, ArcadeDB re-resolves the raw URL string when it opens the connection. It also follows HTTP redirects returned by the remote server. The gap between the validation resolution and the connection resolution creates a time-of-check to time-of-use (TOCTOU) condition suited for DNS rebinding. Redirect following provides a second, simpler bypass path.

Because the validator does not enforce a scheme allowlist on the final resolved target, attackers can reach http://169.254.169.254/ cloud metadata endpoints, internal RFC1918 addresses, and file:// URIs to read local files from disk.

Root Cause

The root cause is duplicate, inconsistent URL resolution combined with unrestricted redirect following. The security check operates on the parsed URL, but the HTTP client re-parses and re-resolves the URL at connection time. The validator does not pin the resolved IP address and does not re-validate the target of an HTTP 3xx redirect against the blocklist.

Attack Vector

An authenticated ArcadeDB user issues an IMPORT DATABASE command referencing an attacker-controlled hostname. The attacker's DNS server returns a benign public IP for the first resolution, satisfying the validator. On the second resolution, the DNS server returns an internal address such as 169.254.169.254 or 127.0.0.1. Alternatively, the attacker's web server responds with an HTTP 302 redirect to an internal URL, and ArcadeDB follows it without re-validation. The resulting response is returned to the attacker through the import workflow, exposing metadata credentials, internal service responses, or local file contents.

No verified public exploit code is available. See the GitHub Security Advisory GHSA-4w2m-77c8-83mw and the VulnCheck Advisory for ArcadeDB SSRF for technical details.

Detection Methods for CVE-2026-75844

Indicators of Compromise

ArcadeDB audit or application logs containing IMPORT DATABASE statements with external or unusual URLs
Outbound HTTP requests from ArcadeDB hosts to 169.254.169.254, metadata.google.internal, or 100.100.100.200
DNS queries from ArcadeDB servers returning rapidly changing A records for the same hostname
file:// URI references in ArcadeDB command history or query logs

Detection Strategies

Alert on any IMPORT DATABASE command whose URL points to a non-approved external or internal host.
Correlate short-TTL DNS responses from ArcadeDB hosts with subsequent connections to link-local or RFC1918 addresses.
Detect HTTP 3xx redirect chains initiated by the ArcadeDB process that terminate on internal endpoints.
Flag responses from ArcadeDB that return cloud metadata JSON structures containing IAM credential fields.

Monitoring Recommendations

Enable ArcadeDB command auditing and forward logs to a centralized SIEM for retention and search.
Monitor egress traffic from database servers with strict allowlists for expected destinations.
Track process-level network activity on ArcadeDB hosts to identify unexpected outbound flows to metadata IPs.

How to Mitigate CVE-2026-75844

Immediate Actions Required

Upgrade ArcadeDB to version 26.8.1 or later on all affected instances.
Restrict who holds permissions to execute IMPORT DATABASE and audit existing role grants.
Block outbound access from ArcadeDB hosts to link-local metadata addresses such as 169.254.169.254.
Rotate any cloud IAM credentials that may have been exposed through the instance metadata service.

Patch Information

The ArcadeDB maintainers addressed the flaw in version 26.8.1. The fix aligns validator resolution with the connection-time resolution and constrains redirect following. Review the GitHub Security Advisory GHSA-4w2m-77c8-83mw for authoritative release notes and upgrade guidance.

Workarounds

Enforce IMDSv2 on AWS instances hosting ArcadeDB to require session tokens for metadata access.
Apply egress firewall rules that deny ArcadeDB hosts from reaching 169.254.0.0/16, 127.0.0.0/8, and private ranges outside approved destinations.
Remove the IMPORT DATABASE privilege from all non-administrative accounts until the patch is applied.
Run ArcadeDB under a service account without read access to sensitive local files to limit file:// exposure.

bash

# Configuration example: restrict egress from ArcadeDB host to cloud metadata
iptables -A OUTPUT -m owner --uid-owner arcadedb -d 169.254.169.254 -j DROP
iptables -A OUTPUT -m owner --uid-owner arcadedb -d 127.0.0.0/8 -j DROP