CVE-2026-119575

CVSS 7.1 (high) · published 2026-10-30

ArcadeDB from 26.8.1 before 26.10.2 contains a server-side request forgery vulnerability that allows authenticated users with updateDatabaseSettings to disable the LOAD CSV IP block list via ALTER DATABASE. Attackers can set arcadedb.opencypher.loadCsv.blockedIpRanges to an empty string, then issue LOAD CSV requests to read cloud metadata and internal loopback or private services.

Weakness: CWE-918

Source: NVD CVE-2026-119575

References

• https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-cc88-w7hj-6h8f
• https://www.vulncheck.com/advisories/arcadedb-26.8.1-before-26.10.2-ssrf-via-alter-database-load-csv-block-list
• https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-cc88-w7hj-6h8f

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.