CVE-2026-75844

Name of the Vulnerable Software and Affected Versions ArcadeDB versions prior to 26.8.1

Description Authenticated attackers can perform a server-side request forgery (SSRF) via the IMPORT DATABASE command. The issue occurs because the security validator resolves and checks hostnames, but the subsequent connection re-resolves the raw URL and follows redirects. This allows the validator to be bypassed using DNS rebinding or HTTP redirects to access internal services, cloud metadata endpoints, or read arbitrary local files on default installations.

Recommendations Update to version 26.8.1 or later.