Is CVE-2026-119575 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-119575 being exploited in the wild.

How severe is CVE-2026-119575?

Medium severity, with a CVSS score of 6.5, published 30 October 2026.

Which products and versions are affected?

ArcadeData ArcadeDB 26.8.1 before 26.10.2.

Is there a fix for CVE-2026-119575?

Yes: fixed in 26.10.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-119575 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-119575?

Check whether you run ArcadeData ArcadeDB at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-119575: ArcadeDB server-side request forgery in LOAD CSV

CVE-2026-119575 · Severity: medium · CVSS 6.5 · Published 2026-10-30

ArcadeDB is a database platform that supports OpenCypher queries, including LOAD CSV to read files from URLs. An authenticated user with database administration permissions can clear the security filters that prevent the server from connecting to internal networks, then use LOAD CSV to read cloud metadata and internal services. An attacker can retrieve sensitive information like authentication credentials stored in cloud metadata or data from services running only on the database server.

Technologies: ArcadeData ArcadeDB. Vendors: ArcadeData.

Quick answers

Is CVE-2026-119575 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-119575 being exploited in the wild.
How severe is CVE-2026-119575?: Medium severity, with a CVSS score of 6.5, published 30 October 2026.
Which products and versions are affected?: ArcadeData ArcadeDB 26.8.1 before 26.10.2.
Is there a fix for CVE-2026-119575?: Yes: fixed in 26.10.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-119575 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-119575?: Check whether you run ArcadeData ArcadeDB at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 26.10.2

Technical details

The vulnerability is a server-side request forgery in ArcadeDB's LOAD CSV implementation. An authenticated user with updateDatabaseSettings permission can use ALTER DATABASE to set the arcadedb.opencypher.loadCsv.blockedIpRanges configuration to an empty string, disabling the IP block list that restricts LOAD CSV requests to internal ranges. The SafeHttpFetcher predicate treats an empty block list as no filtering rather than failing closed, allowing subsequent LOAD CSV queries to reach loopback, RFC 1918, and link-local addresses including AWS metadata endpoints (169.254.169.254). The full response body is returned as query rows, enabling full-response SSRF attacks.

Affected products

ArcadeData ArcadeDB 26.8.1 before 26.10.2

Timeline

2026-10-15: advisory
2026-10-30: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.