CVE-2026-75844 in ArcadeDB
Summary
by MITRE • 08/18/2026
ArcadeDB versions before 26.8.1 contain a server-side request forgery vulnerability in the IMPORT DATABASE command where the security validator resolves and checks hostnames but the subsequent connection re-resolves the raw URL and follows redirects. Authenticated attackers can bypass the validator using DNS rebinding or HTTP redirects to access cloud metadata endpoints, internal services, or read arbitrary local files on default installations.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/18/2026
ArcadeDB versions prior to 26.8.1 are affected by a critical server-side request forgery vulnerability within the IMPORT DATABASE command functionality. This flaw stems from an inconsistent implementation of security validation logic during network resource access. The application employs a security validator that initially resolves and checks hostnames against a whitelist or blacklist before initiating connections. However, this check is performed on the original input string rather than the final resolved destination after DNS resolution and HTTP redirect processing. Consequently, attackers can exploit this discrepancy by leveraging DNS rebinding techniques or configuring servers to issue HTTP redirects to bypass the initial validation layer. This architectural flaw allows authenticated users to direct internal database operations toward unintended targets that were not permitted during the initial security check phase.
The operational impact of this vulnerability is severe due to its potential for data exfiltration and lateral movement within protected network environments. Authenticated attackers can utilize this mechanism to access cloud metadata endpoints, such as those provided by AWS EC2 or Azure Managed Identity services, which often contain sensitive authentication tokens and configuration details. Furthermore, the flaw enables access to internal microservices that are not exposed to public internet traffic but may be reachable from within the host network where ArcadeDB is deployed. In default installation configurations, this vulnerability also permits reading arbitrary local files on the server operating system by directing requests to file:// URIs or through redirect chains that resolve to local paths. This capability effectively compromises the confidentiality and integrity of both application data and underlying infrastructure credentials.
From a classification perspective, this issue aligns with CWE-918 Server-Side Request Forgery (SSRF), specifically illustrating weaknesses in URL validation logic where initial checks do not account for subsequent network behavior changes such as redirects or DNS rebinding attacks. The exploitation technique maps to MITRE ATT&CK techniques including T1071 Application Layer Protocol for the use of HTTP/HTTPS protocols and potentially T1592 Gather Victim Host Information if used to probe internal services, though primarily it represents a classic SSRF scenario where trust boundaries are violated due to improper validation of dynamic network destinations. The vulnerability highlights the importance of validating resources after all transformations have occurred rather than relying solely on pre-connection checks.
To mitigate this risk, organizations running ArcadeDB versions before 26.8.1 should immediately upgrade to version 26.8.1 or later where these security controls have been hardened. Until an upgrade is feasible, administrators can implement network-level mitigations such as restricting outbound traffic from the database server using firewall rules that block access to cloud metadata IP ranges and internal service subnets. Additionally, disabling unnecessary protocols like file:// URIs in configuration settings may reduce the attack surface if supported by the specific deployment context. It is also advisable to enforce strict input validation at the application layer for any custom integrations involving external resource imports and to monitor logs for unusual patterns of DNS resolution or HTTP redirect activity originating from database import operations.