Executive brief
ArcadeDB is a database server that supports importing data from remote URLs via the IMPORT DATABASE command. An authenticated user can exploit a flaw in the security validator that allows bypassing hostname checks through DNS rebinding or HTTP redirects, potentially accessing cloud metadata services, internal systems, or reading arbitrary local files on the server.
Technical details
The vulnerability is a server-side request forgery (SSRF) caused by an incomplete fix to a prior SSRF flaw (CVE-2026-54077). The ImportSecurityValidator resolves a hostname and checks it against a blocklist, but then discards the resolved addresses. When the actual connection is made via HttpURLConnection.openConnection(), it re-resolves the hostname independently and follows HTTP 3xx redirects by default, allowing an attacker to bypass the validator. An authenticated user can provide a URL pointing to their attacker-controlled host, which returns a 302 redirect to an internal target (e.g., 169.254.169.254 metadata endpoint), or use DNS rebinding to return a different IP at connection time. Additionally, the local file read restriction is insecure by default, with SERVER_SECURITY_IMPORT_ALLOWED_LOCAL_PATHS defaulting to empty, permitting arbitrary file:// reads. Exploitation requires authentication to the ArcadeDB server.
Affected products
- ArcadeData ArcadeDB before 26.8.1
Timeline
- 2026-08-18: disclosed: CVE-2026-75844 published
- 2026-08-04: patched: Fix released in version 26.8.1