CVE-2026-76225

Name of the Vulnerable Software and Affected Versions ArcadeDB versions prior to 26.8.1

Description An issue exists in the OpenCypher LOAD CSV implementation that fails to validate HTTP/HTTPS URLs. Authenticated attackers can craft LOAD CSV queries pointing to internal network addresses or cloud metadata endpoints, causing the server to fetch and return sensitive data from restricted services. This is a server-side request forgery, which occurs when a server is tricked into making requests to an unintended location.

Recommendations Update ArcadeDB to version 26.8.1 or later.