CVE-2026-76225 describes an SSRF vulnerability in ArcadeDB prior to version 26.8.1. The issue exists in the OpenCypher LOAD CSV implementation, which fails to validate URLs used in queries. Authenticated attackers can exploit this by crafting LOAD CSV queries that direct the server to access internal or restricted network resources, including cloud metadata services, thereby potentially leaking sensitive data. The CVSS 4.0 score is 8.3, indicating high severity with network attack vector, low attack complexity, no user interaction, and high impact on confidentiality.

An attacker with authentication privileges can leverage this vulnerability to make the ArcadeDB server perform unauthorized HTTP/HTTPS requests to internal network addresses or cloud metadata endpoints. This can lead to disclosure of sensitive internal information that is otherwise inaccessible, increasing the risk of further attacks or data breaches. There is no indication of privilege escalation or integrity/availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions before 26.8.1, upgrading to version 26.8.1 or later is likely to address the issue once the vendor releases a fix. Until then, restrict access to authenticated users and monitor query usage to detect suspicious LOAD CSV queries targeting internal resources.