CVE-2026-93597: Server-Side Request Forgery (SSRF) in ArcadeData arcadedb
ArcadeDB versions before 26.9.1 fail to validate IPv6 transition addresses in the SSRF guard used by IMPORT DATABASE and server commands. Authenticated attackers can supply URLs resolving to NAT64, 6to4, or Teredo addresses embedding RFC 1918 or loopback IPv4 payloads to reach internal services and cloud metadata endpoints.
AI Analysis
Technical Summary
ArcadeDB versions prior to 26.9.1 do not correctly validate IPv6 transition addresses (such as NAT64, 6to4, or Teredo) in the SSRF guard mechanisms for the IMPORT DATABASE and server commands. This allows authenticated attackers to craft URLs that resolve to these IPv6 transition addresses embedding RFC 1918 or loopback IPv4 addresses, bypassing SSRF protections and enabling requests to internal network services or cloud metadata endpoints.
Potential Impact
An authenticated attacker can exploit this vulnerability to perform SSRF attacks that reach internal services and cloud metadata endpoints, potentially exposing sensitive internal resources or configuration data. The CVSS 4.0 score of 5.3 indicates a medium severity impact with network attack vector, low attack complexity, and limited privileges required.
Mitigation Recommendations
A fix is available in ArcadeDB version 26.9.1. Users should upgrade to version 26.9.1 or later to remediate this vulnerability. Until patched, restrict access to the affected commands to trusted users only and monitor for suspicious activity related to SSRF attempts.
CVE-2026-93597: Server-Side Request Forgery (SSRF) in ArcadeData arcadedb
Description
ArcadeDB versions before 26.9.1 fail to validate IPv6 transition addresses in the SSRF guard used by IMPORT DATABASE and server commands. Authenticated attackers can supply URLs resolving to NAT64, 6to4, or Teredo addresses embedding RFC 1918 or loopback IPv4 payloads to reach internal services and cloud metadata endpoints.
CVSS v4.0
Score 5.3medium
Affected software
ArcadeData
arcadedb
pkg:github/arcadedata/arcadedbRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
ArcadeDB versions prior to 26.9.1 do not correctly validate IPv6 transition addresses (such as NAT64, 6to4, or Teredo) in the SSRF guard mechanisms for the IMPORT DATABASE and server commands. This allows authenticated attackers to craft URLs that resolve to these IPv6 transition addresses embedding RFC 1918 or loopback IPv4 addresses, bypassing SSRF protections and enabling requests to internal network services or cloud metadata endpoints.
Potential Impact
An authenticated attacker can exploit this vulnerability to perform SSRF attacks that reach internal services and cloud metadata endpoints, potentially exposing sensitive internal resources or configuration data. The CVSS 4.0 score of 5.3 indicates a medium severity impact with network attack vector, low attack complexity, and limited privileges required.
Mitigation Recommendations
A fix is available in ArcadeDB version 26.9.1. Users should upgrade to version 26.9.1 or later to remediate this vulnerability. Until patched, restrict access to the affected commands to trusted users only and monitor for suspicious activity related to SSRF attempts.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-09-18T11:00:32.755Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6aad3d5b55bf5e2cf51004f3
Added to database: 09/18/2026, 13:32:11 UTC
Last enriched: 09/18/2026, 13:47:38 UTC
Last updated: 09/18/2026, 22:17:54 UTC
Views: 11
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.