CVE-2026-119575— ArcadeDB 26.8.1 before 26.10.2 SSRF via ALTER DATABASE LOAD CSV Block List

Quick assessment

Affected

ArcadeData arcadedb

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

ArcadeDB 26.8.1 至 26.10.2（不含）版本中存在一个服务器端请求伪造（SSRF）漏洞。拥有权限的已认证用户可通过命令禁用的 IP 阻止列表。攻击者可将参数设置为空字符串，随后发起请求，从而读取云元数据以及内部回环地址或私有服务。

CVSS 6.5 · Medium Updated Oct 30, 2026

Possible ATT&CK Techniques 2 AI

T1046 · Network Service Discovery T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

ArcadeDB 26.8.1 before 26.10.2 SSRF via ALTER DATABASE LOAD CSV Block List

Source: CVE Program / CVE List V5

Vulnerability Description

ArcadeDB from 26.8.1 before 26.10.2 contains a server-side request forgery vulnerability that allows authenticated users with updateDatabaseSettings to disable the LOAD CSV IP block list via ALTER DATABASE. Attackers can set arcadedb.opencypher.loadCsv.blockedIpRanges to an empty string, then issue LOAD CSV requests to read cloud metadata and internal loopback or private services.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

服务端请求伪造(SSRF)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
ArcadeData	arcadedb	26.8.1 ~ 26.10.2	-

II. Public POCs for CVE-2026-119575

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-119575

请登录查看更多情报信息。

Other References for CVE-2026-119575 (2)

https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-cc88-w7hj-6h8f vendor-advisory
https://www.vulncheck.com/advisories/arcadedb-26.8.1-before-26.10.2-ssrf-via-alter-database-load-csv-block-list third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-119575

Same Patch Batch · ArcadeData · 2026-10-30 · 3 CVEs total

CVE-2026-119577	6.8 MEDIUM	ArcadeDB before 26.10.2 Improper Session Revocation in Wire-Protocol Connections
CVE-2026-119576	4.3 MEDIUM	ArcadeDB from 21.12.1 before 26.10.2 GraphQL Schema Replacement via Read-Only Query Endpoi

IV. Related Vulnerabilities

Same product: arcadedb

Same vendor: ArcadeData

Same weakness: CWE-918