CVE-2026-119575

ArcadeDB 26.8.1 before 26.10.2 SSRF via ALTER DATABASE LOAD CSV Block List

7.1 High

ArcadeDB from 26.8.1 before 26.10.2 contains a server-side request forgery vulnerability that allows authenticated users with updateDatabaseSettings to disable the LOAD CSV IP block list via ALTER DATABASE. Attackers can set arcadedb.opencypher.loadCsv.blockedIpRanges to an empty string, then issue LOAD CSV requests to read cloud metadata and internal loopback or private services.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

0.26%Unchanged since Oct 31, 2026

What each source reports

CVE List Score used 7.1

ArcadeDB 26.8.1 before 26.10.2 SSRF via ALTER DATABASE LOAD CSV Block List

Record: CVE-2026-119575
CVSS 4.0: 7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-918
Updated: 2026-11-04

EUVDEUVD-2026-113929 7.1

Record: EUVD-2026-113929
CVSS 4.0: 7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Updated: 2026-11-04

GitHub AdvisoriesGHSA-vqh4-vww9-5p94 7.1

ArcadeDB from 26.8.1 before 26.10.2 contains a server-side request forgery vulnerability that...

Record: GHSA-vqh4-vww9-5p94
CVSS 4.0: 7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-918
Updated: 2026-11-02

NVD 7.1

Record: CVE-2026-119575
CVSS 4.0: 7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-918
Updated: 2026-11-05

OSV 7.1

ArcadeDB 26.8.1 before 26.10.2 SSRF via ALTER DATABASE LOAD CSV Block List

Record: CVE-2026-119575
CVSS 4.0: 7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Weakness: CWE-918
Updated: 2026-11-05

Affected products

arcadedata arcadedb

History

History
Recorded	Changed	Sources
Nov 4, 2026	facts, references	CVE List
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-119575 is a high vulnerability (CVSS 7.1) in Arcadedata Arcadedb, published October 30, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.26%, the 17th percentile. No source names a fixed version.