Is CVE-2026-75844 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-75844 being exploited in the wild.

How severe is CVE-2026-75844?

High severity, with a CVSS score of 7.1, published 18 August 2026.

Which products and versions are affected?

ArcadeData ArcadeDB before 26.8.1.

Is there a fix for CVE-2026-75844?

A patch was published on 2026-08-04: Fix released in version 26.8.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-75844 attacked?

It is attacked over the network.

Am I affected by CVE-2026-75844?

Check whether you run ArcadeData ArcadeDB at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-75844: ArcadeDB server-side request forgery in IMPORT DATABASE

CVE-2026-75844 · Severity: high · CVSS 7.1 · Published 2026-08-18

ArcadeDB is a database server that supports importing data from remote URLs via the IMPORT DATABASE command. An authenticated user can exploit a flaw in the security validator that allows bypassing hostname checks through DNS rebinding or HTTP redirects, potentially accessing cloud metadata services, internal systems, or reading arbitrary local files on the server.

Technologies: ArcadeData ArcadeDB. Vendors: ArcadeData.

Quick answers

Is CVE-2026-75844 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-75844 being exploited in the wild.
How severe is CVE-2026-75844?: High severity, with a CVSS score of 7.1, published 18 August 2026.
Which products and versions are affected?: ArcadeData ArcadeDB before 26.8.1.
Is there a fix for CVE-2026-75844?: A patch was published on 2026-08-04: Fix released in version 26.8.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-75844 attacked?: It is attacked over the network.
Am I affected by CVE-2026-75844?: Check whether you run ArcadeData ArcadeDB at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a server-side request forgery (SSRF) caused by an incomplete fix to a prior SSRF flaw (CVE-2026-54077). The ImportSecurityValidator resolves a hostname and checks it against a blocklist, but then discards the resolved addresses. When the actual connection is made via HttpURLConnection.openConnection(), it re-resolves the hostname independently and follows HTTP 3xx redirects by default, allowing an attacker to bypass the validator. An authenticated user can provide a URL pointing to their attacker-controlled host, which returns a 302 redirect to an internal target (e.g., 169.254.169.254 metadata endpoint), or use DNS rebinding to return a different IP at connection time. Additionally, the local file read restriction is insecure by default, with SERVER_SECURITY_IMPORT_ALLOWED_LOCAL_PATHS defaulting to empty, permitting arbitrary file:// reads. Exploitation requires authentication to the ArcadeDB server.

Affected products

ArcadeData ArcadeDB before 26.8.1

Timeline

2026-08-18: disclosed: CVE-2026-75844 published
2026-08-04: patched: Fix released in version 26.8.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.