CVE-2026-119575Medium· 6.5▾ TwilightPoC availableArcadeDB from 26.8.1 before 26.10.2 contains a server-side request forgery vulnerability that allows authenticated users with updateDatabaseSettings to disable the LOAD CSV IP block list via ALTER DATABASE. Attackers can set arcadedb.ope…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 35.8 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.3%
ArcadeDB from 26.8.1 before 26.10.2 contains a server-side request forgery vulnerability that allows authenticated users with updateDatabaseSettings to disable the LOAD CSV IP block list via ALTER DATABASE. Attackers can set arcadedb.opencypher.loadCsv.blockedIpRanges to an empty string, then issue LOAD CSV requests to read cloud metadata and internal loopback or private services.
arcadedb >= 26.8.1 < 26.10.2Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-93597High· 7.7ArcadeDB versions before 26.9.1 fail to validate IPv6 transition addresses in the SSRF guard used by IMPORT DATABASE and server commands
CVE-2026-54077High· 7.1ArcadeDB is a Multi-Model DBMS
CVE-2026-119576Medium· 4.3ArcadeDB from 21.12.1 before 26.10.2 GraphQL Schema Replacement via Read-Only Query Endpoint
CVE-2026-114056Medium· 4.3ArcadeDB from 26.8.1 before 26.10.1 Authorization Bypass via ALTER TYPE WITH
CVE-2026-114057Medium· 4.3ArcadeDB 26.2.1 before 26.10.1 Bolt SHOW DATABASES Information Disclosure
CVE-2026-114058Medium· 4.3ArcadeDB from 26.2.1 before 26.10.1 Missing Authorization via Bolt Protocol