ArcadeDB SSRF flaw lets authenticated users disable LOAD CSV IP block list (EUVD-2026-113929)
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- ArcadeData
- Product
- ArcadeDB
- First seen
Summary
The EU Vulnerability Database (EUVD) lists a server-side request forgery vulnerability in ArcadeDB from 26.8.1 before 26.10.2, scored 7.1/10 (CVSS v3.1). According to the entry, users with updateDatabaseSettings can disable the LOAD CSV IP block list through ALTER DATABASE.
If you use ArcadeData
Upgrade ArcadeDB to 26.10.2 or later
Restrict which users hold updateDatabaseSettings
Review database settings for changes to LOAD CSV controls
Audit users who hold only readRecord permissions
Check the shared GraphQL schema for unexpected changes
Restart ArcadeDB to close connections opened before revocation
What the sources say 3
· Mastodon: “ArcadeDB before 26.10.2 contains an improper authorization vulnerability that allows revoked users to retain access through already-open Postgres, Bolt, MongoDB, or Redis wire-protocol connections.” Source
· Mastodon: “ArcadeDB from 21.12.1 before 26.10.2 contains an authorization bypass vulnerability that allows users with only readRecord to replace the shared GraphQL schema via the read-only query endpoint.” Source
· Mastodon: “ArcadeDB from 26.8.1 before 26.10.2 contains a server-side request forgery vulnerability that allows authenticated users with updateDatabaseSettings to disable the LOAD CSV IP block list via ALTER DATABASE.” Source