CVE-2026-76225
HighCVSS 7.7Summary
ArcadeDB before 26.8.1 contains a server-side request forgery vulnerability in the OpenCypher LOAD CSV implementation that fails to validate HTTP/HTTPS URLs. Authenticated attackers can craft LOAD CSV queries pointing to internal network addresses or cloud metadata endpoints to make the ArcadeDB server fetch and return sensitive data from restricted services.
Risk Assessment
An attacker can use the server to access internal network resources or cloud metadata, potentially leading to leakage of sensitive data such as credentials or access keys.
Recommendation
Upgrade ArcadeDB to version 26.8.1 or later, which includes the fix, and restrict access to the LOAD CSV functionality to trusted users only.
Original NVD description (English source)
ArcadeDB before 26.8.1 contains a server-side request forgery vulnerability in the OpenCypher LOAD CSV implementation that fails to validate HTTP/HTTPS URLs. Authenticated attackers can craft LOAD CSV queries pointing to internal network addresses or cloud metadata endpoints to make the ArcadeDB server fetch and return sensitive data from restricted services.