CVE-2026-75844 is a server-side request forgery vulnerability affecting ArcadeDB versions before 26.8.1. The flaw exists in the IMPORT DATABASE command where the security validator performs hostname resolution and validation, but the subsequent connection process re-resolves the raw URL and follows HTTP redirects. This discrepancy enables authenticated attackers to bypass the hostname validation by leveraging DNS rebinding or HTTP redirects, potentially allowing them to access sensitive internal services, cloud metadata endpoints, or read arbitrary local files on default installations.

An authenticated attacker can exploit this SSRF vulnerability to bypass hostname validation and access internal network resources, cloud metadata endpoints, or local files. This could lead to unauthorized information disclosure and potentially further compromise of the affected system. The CVSS 4.0 score of 7.1 reflects a high severity with network attack vector, low attack complexity, and no user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch link is provided, users should monitor the vendor's announcements for updates. In the meantime, restrict access to the IMPORT DATABASE command to trusted users only and consider network-level controls to limit outbound requests from the database server.