CVE-2026-119575 in ArcadeDB
Summary
by MITRE • 10/30/2026
ArcadeDB from 26.8.1 before 26.10.2 contains a server-side request forgery vulnerability that allows authenticated users with updateDatabaseSettings to disable the LOAD CSV IP block list via ALTER DATABASE. Attackers can set arcadedb.opencypher.loadCsv.blockedIpRanges to an empty string, then issue LOAD CSV requests to read cloud metadata and internal loopback or private services.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/30/2026
ArcadeDB versions prior to 26.10.2 contain a critical server-side request forgery vulnerability that stems from insufficient validation of database configuration parameters during the ALTER DATABASE operation. This flaw specifically affects authenticated users who possess updateDatabaseSettings privileges, allowing them to manipulate internal security controls without requiring administrative or superuser rights. The core technical issue lies in the handling of the arcadedb.opencypher.loadCsv.blockedIpRanges property, which is designed to restrict data loading operations from specific IP ranges for security purposes. However, due to a lack of strict input validation and sanitization within the configuration update logic, an attacker can successfully set this parameter to an empty string or otherwise neutralize its filtering capabilities. This action effectively disables the built-in block list that prevents malicious LOAD CSV requests from targeting internal network resources.
The operational impact of this vulnerability is severe as it enables attackers to pivot into sensitive areas of the infrastructure through cloud metadata services and private loopback addresses. By disabling the IP block list, an attacker can issue OPEN CYpher LOAD CSV commands directed at localhost or other non-routable internal IPs that are typically inaccessible from external networks. This capability allows for the exfiltration of critical data such as AWS instance metadata, Azure managed identity tokens, or Google Cloud service account credentials stored in local configuration files. Furthermore, it facilitates access to internal microservices running on loopback interfaces, potentially leading to further compromise of backend systems that rely on implicit trust relationships and lack additional authentication mechanisms for local connections.
This vulnerability aligns with CWE-918 Server-Side Request Forgery as well as CWE-20 Improper Input Validation within the context of configuration management. From a MITRE ATT&CK perspective, this exploitation technique maps to T1557 Adversary-in-the-Middle for intercepting local communications and potentially T1046 Network Service Discovery if used to map internal services. The attack vector leverages legitimate database administration functions to bypass security controls, highlighting the risk of privilege escalation through misconfigured or poorly validated administrative endpoints.
To mitigate this vulnerability, organizations must immediately upgrade ArcadeDB to version 26.10.2 or later where these input validation checks have been strengthened. In environments where upgrading is not immediately feasible, it is recommended to restrict updateDatabaseSettings privileges strictly to trusted administrators and implement network-level controls such as firewall rules that prevent database processes from initiating outbound connections to cloud metadata endpoints like 169.254.169.254 or internal service IPs. Additionally, deploying web application firewalls with deep packet inspection capabilities can help detect anomalous LOAD CSV requests targeting private IP ranges, providing an additional layer of defense against exploitation attempts.