CVE-2026-93597

HIGHCVSS 7.7

Description

ArcadeDB versions before 26.9.1 fail to validate IPv6 transition addresses in the SSRF guard used by IMPORT DATABASE and server commands. Authenticated attackers can supply URLs resolving to NAT64, 6to4, or Teredo addresses embedding RFC 1918 or loopback IPv4 payloads to reach internal services and cloud metadata endpoints.

Timeline

Published:September 18th, 2026 2:19 PM

Last modified:September 18th, 2026 6:18 PM

CVSS Scoring

CVSS v3: 7.7 (HIGH)

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Weaknesses (CWE)

CWE-918

References & Reports

Advisories, patches, and third-party reports

https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-67m7-7w7g-mpmh
https://www.vulncheck.com/advisories/arcadedb-before-26.9.1-ssrf-via-ipv6-transition-addresses
https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-67m7-7w7g-mpmh

Source: NIST NVD · Data may lag official sources by up to one minute