---
id: CVE-2026-119575
title: ArcadeDB 26.8.1 before 26.10.2 SSRF via ALTER DATABASE LOAD CSV Block List
summary: >-
  ArcadeDB from 26.8.1 before 26.10.2 contains a server-side request forgery
  vulnerability that allows authenticated users with updateDatabaseSettings to
  disable the LOAD CSV IP block list via ALTER DATABASE. Attackers can set
  arcadedb.ope…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-918
vendor: ArcadeData
product: arcadedb
affected:
  - arcadedb >= 26.8.1 < 26.10.2
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-04T22:25:03.447789Z'
exploitAvailable: true
published: '2026-10-30'
updated: '2026-11-04'
sourceUpdated: '2026-11-04T22:25:27.233Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-119575'
references:
  - url: >-
      https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-cc88-w7hj-6h8f
    label: GitHub Security Advisory (GHSA-cc88-w7hj-6h8f)
  - url: >-
      https://www.vulncheck.com/advisories/arcadedb-26.8.1-before-26.10.2-ssrf-via-alter-database-load-csv-block-list
    label: >-
      VulnCheck Advisory: ArcadeDB 26.8.1 before 26.10.2 SSRF via ALTER DATABASE
      LOAD CSV Block List
tags:
  - cve.org
  - exploit-available
epss: 0.00258
epssPercentile: 0.17538
ingestedAt: '2026-11-05T21:36:00.643Z'
---

## Overview

ArcadeDB from 26.8.1 before 26.10.2 contains a server-side request forgery vulnerability that allows authenticated users with updateDatabaseSettings to disable the LOAD CSV IP block list via ALTER DATABASE. Attackers can set arcadedb.opencypher.loadCsv.blockedIpRanges to an empty string, then issue LOAD CSV requests to read cloud metadata and internal loopback or private services.

## Affected

- `arcadedb >= 26.8.1 < 26.10.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.