CVE-2026-93597: ArcadeDB SSRF Vulnerability

CVE-2026-93597 Overview

CVE-2026-93597 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] in ArcadeDB versions before 26.9.1. The flaw resides in the SSRF guard used by the IMPORT DATABASE command and other server commands. The guard fails to validate IPv6 transition addresses, including NAT64, 6to4, and Teredo formats. Authenticated attackers can submit URLs that resolve to IPv6 transition addresses embedding RFC 1918 private ranges or loopback IPv4 payloads. These requests reach internal services and cloud metadata endpoints that the SSRF filter is meant to block.

Critical Impact
Authenticated attackers can bypass ArcadeDB's SSRF protections to access internal network services and cloud instance metadata endpoints such as AWS IMDS.

Affected Products

ArcadeDB versions prior to 26.9.1
Deployments exposing the IMPORT DATABASE command to authenticated users
ArcadeDB server command interfaces reachable over the network

Discovery Timeline

2026-09-18 - CVE-2026-93597 published to the National Vulnerability Database
2026-09-18 - Last updated in NVD database

Technical Details for CVE-2026-93597

Vulnerability Analysis

ArcadeDB implements an SSRF guard to prevent server-side commands from reaching internal or reserved network ranges. The guard inspects URLs supplied to features such as IMPORT DATABASE and blocks common private IPv4 ranges and loopback addresses. However, the validation logic does not normalize IPv6 transition address formats before comparison. IPv6 transition mechanisms embed IPv4 addresses inside IPv6 representations, allowing attackers to express restricted destinations in a form the filter does not recognize.

An authenticated user can therefore supply a URL whose hostname is a NAT64 address (64:ff9b::/96), a 6to4 address (2002::/16), or a Teredo address (2001::/32) that maps to 127.0.0.1, 169.254.169.254, or an RFC 1918 range. The server resolves and dispatches the request, reaching internal HTTP services, orchestration APIs, and cloud metadata endpoints. Successful exploitation exposes limited confidentiality and integrity impact on internal systems while requiring authenticated access.

Root Cause

The SSRF guard performs textual or single-family address checks without canonicalizing IPv6 transition formats. Addresses such as ::ffff:169.254.169.254, 2002:a9fe:a9fe::, and 64:ff9b::a9fe:a9fe all resolve to 169.254.169.254 at the network layer, but the validator treats them as arbitrary public IPv6 destinations. This missing normalization defeats the deny list.

Attack Vector

Exploitation requires authenticated network access to an ArcadeDB server. The attacker invokes a server command that accepts a URL, typically IMPORT DATABASE, and supplies a target using one of the IPv6 transition encodings. The server issues an outbound request to the embedded IPv4 destination. Attackers commonly target cloud metadata services to obtain temporary credentials or reach internal control planes.

Refer to the GitHub Security Advisory GHSA-67m7 and the VulnCheck Advisory for ArcadeDB SSRF for additional technical detail. No public proof-of-concept exploit is currently available.

Detection Methods for CVE-2026-93597

Indicators of Compromise

Outbound HTTP requests from ArcadeDB server processes to IPv6 addresses in ranges 64:ff9b::/96, 2002::/16, or 2001::/32.
Server logs showing IMPORT DATABASE or other server commands referencing IPv6 URLs from authenticated sessions.
Access attempts from the ArcadeDB host to cloud metadata endpoints such as 169.254.169.254 or fd00:ec2::254.

Detection Strategies

Monitor ArcadeDB command audit logs for IMPORT DATABASE invocations containing IPv6 literals or hostnames resolving to transition-address ranges.
Alert on any egress from database hosts to link-local, loopback, or metadata addresses regardless of IP family.
Correlate authenticated ArcadeDB sessions with unusual outbound network flows initiated shortly after command execution.

Monitoring Recommendations

Enable verbose command logging on ArcadeDB and forward events to a centralized analytics platform for URL inspection.
Instrument network telemetry to decode NAT64, 6to4, and Teredo destinations and evaluate the embedded IPv4 target against internal deny lists.
Track authentication events for accounts permitted to run server commands and flag rare or off-hours use.

How to Mitigate CVE-2026-93597

Immediate Actions Required

Upgrade ArcadeDB to version 26.9.1 or later on all server instances.
Restrict which authenticated roles can execute IMPORT DATABASE and other URL-accepting server commands.
Block outbound traffic from ArcadeDB hosts to cloud metadata endpoints and reserved IPv4 or IPv6 ranges at the network layer.

Patch Information

ArcadeDB has released version 26.9.1, which extends the SSRF guard to normalize IPv6 transition addresses before validation. Review the fix and upgrade instructions in the GitHub Security Advisory GHSA-67m7.

Workarounds

Place ArcadeDB servers behind an egress proxy that enforces destination allow lists and rejects IPv6 transition prefixes.
Disable server commands that accept remote URLs where they are not required for operations.
Rotate cloud instance credentials and enforce IMDSv2 with session tokens on AWS to reduce metadata exposure.

bash

# Configuration example: block IPv6 transition prefixes and IMDS from the ArcadeDB host
iptables -A OUTPUT -d 169.254.169.254 -j REJECT
ip6tables -A OUTPUT -d 64:ff9b::/96 -j REJECT
ip6tables -A OUTPUT -d 2002::/16 -j REJECT
ip6tables -A OUTPUT -d 2001::/32 -j REJECT