CVE-2026-76225CWE-918ssrf

CVE-2026-76225

High · published August 19, 2026

CVSS v3.1
7.7
EPSS
0%
Percentile
27.8
In the wild
Unconfirmed
What it is

ArcadeDB before 26.8.1 contains a server-side request forgery vulnerability in the OpenCypher LOAD CSV implementation that fails to validate HTTP/HTTPS URLs. Authenticated attackers can craft LOAD CSV queries pointing to internal network addresses or cloud metadata endpoints to make the ArcadeDB server fetch and return sensitive data from restricted services.

The record
Technical detail
CVSS v3.1
7.7 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
CVSS v4.0
8.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
EPSS
0.00354 · 27.8th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-08-19T18:17Z
References (3)
https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-mmww-w3w3-6r86 · [email protected]https://www.vulncheck.com/advisories/arcadedb-before-server-side-request-forgery-via-load-csv · [email protected]https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-mmww-w3w3-6r86 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 19 AUG 14:02Z
    ArcadeDB before 26.8.1 Server-Side Request Forgery via LOAD CSV
    cvelistv5