CVE-2026-76225 Overview
CVE-2026-76225 is a server-side request forgery (SSRF) vulnerability in ArcadeDB versions prior to 26.8.1. The flaw resides in the OpenCypher LOAD CSV implementation, which fails to validate HTTP and HTTPS URLs supplied to the query. Authenticated attackers can craft LOAD CSV statements that direct the ArcadeDB server to fetch arbitrary internal endpoints, including cloud metadata services and non-public network hosts. The server returns the fetched content to the attacker, exposing sensitive data from restricted services. The issue is tracked as CWE-918: Server-Side Request Forgery.
Critical Impact
Authenticated attackers can pivot through ArcadeDB to reach internal-only services and cloud metadata endpoints, disclosing credentials, tokens, and infrastructure data.
Affected Products
- ArcadeDB versions before 26.8.1
- OpenCypher LOAD CSV query interface
- Deployments exposing the ArcadeDB HTTP API to authenticated users
Discovery Timeline
- 2026-08-19 - CVE-2026-76225 published to NVD
- 2026-08-19 - Last updated in NVD database
Technical Details for CVE-2026-76225
Vulnerability Analysis
ArcadeDB supports the OpenCypher query language, which includes a LOAD CSV clause for ingesting external CSV data over HTTP or HTTPS. In versions before 26.8.1, the server does not validate the destination URL before issuing the outbound request. Any authenticated user with permission to execute Cypher queries can supply URLs pointing to internal hostnames, loopback interfaces, or link-local addresses. The server performs the request using its own network position and returns the response body to the caller. This behavior turns the database into a proxy for reaching services that should be unreachable from external networks.
Root Cause
The root cause is missing URL validation in the LOAD CSV handler. The implementation accepts any HTTP or HTTPS scheme without applying an allowlist, denylist, or DNS resolution check. There is no restriction against private RFC 1918 ranges, loopback addresses, or the 169.254.169.254 metadata endpoint used by AWS, Azure, and GCP. The vulnerability maps to CWE-918.
Attack Vector
An authenticated attacker submits an OpenCypher query containing a LOAD CSV FROM clause pointing to an internal target such as http://169.254.169.254/latest/meta-data/iam/security-credentials/. ArcadeDB fetches the URL server-side and parses the response as CSV rows, which the attacker retrieves through the normal query result channel. The attacker can enumerate internal services, harvest cloud instance credentials, or read metadata that reveals infrastructure topology. Detailed exploitation notes are available in the GitHub Security Advisory GHSA-mmww-w3w3-6r86 and the VulnCheck Advisory.
Detection Methods for CVE-2026-76225
Indicators of Compromise
- OpenCypher queries in ArcadeDB logs containing LOAD CSV FROM with URLs referencing 127.0.0.1, localhost, RFC 1918 ranges, or 169.254.169.254.
- Outbound HTTP requests from the ArcadeDB process to internal-only hosts or cloud metadata endpoints.
- Unusual query activity from low-privilege database accounts targeting the /api/v1/command endpoint with Cypher payloads.
Detection Strategies
- Parse ArcadeDB query audit logs for LOAD CSV statements and flag any URL whose host resolves to a private, loopback, or link-local address.
- Inspect network flow telemetry for connections originating from the database server to metadata services or unexpected internal ports.
- Correlate authenticated database sessions with outbound HTTP requests initiated by the ArcadeDB JVM process.
Monitoring Recommendations
- Enable ArcadeDB query auditing and forward logs to a centralized platform for retention and correlation.
- Alert on any successful HTTP response from the ArcadeDB server originating from a request to 169.254.169.254.
- Track privilege usage for accounts that gained Cypher execution rights and review query patterns for anomalies.
How to Mitigate CVE-2026-76225
Immediate Actions Required
- Upgrade ArcadeDB to version 26.8.1 or later on all server instances.
- Rotate cloud instance credentials and API tokens accessible from the ArcadeDB host if exploitation is suspected.
- Audit user roles and remove Cypher execution privileges from accounts that do not require them.
Patch Information
The ArcadeDB maintainers released a fix in version 26.8.1 that adds URL validation to the OpenCypher LOAD CSV handler. Consult the GitHub Security Advisory GHSA-mmww-w3w3-6r86 for release details and the VulnCheck Advisory for additional analysis.
Workarounds
- Restrict egress from the ArcadeDB host with firewall rules that block access to 169.254.169.254 and other sensitive internal ranges.
- Place ArcadeDB behind an egress proxy that enforces an allowlist of permitted CSV source domains.
- Disable or restrict the OpenCypher LOAD CSV functionality for non-administrative roles until patching is complete.
# Example egress restriction using iptables to block cloud metadata access from the ArcadeDB host
iptables -A OUTPUT -d 169.254.169.254 -j DROP
iptables -A OUTPUT -d 127.0.0.0/8 -p tcp -j DROP
iptables -A OUTPUT -d 10.0.0.0/8 -p tcp --dport 80 -j DROP
iptables -A OUTPUT -d 192.168.0.0/16 -p tcp --dport 80 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
