Description

ArcadeDB versions before 26.8.1 contain a server-side request forgery vulnerability in the IMPORT DATABASE command where the security validator resolves and checks hostnames but the subsequent connection re-resolves the raw URL and follows redirects. Authenticated attackers can bypass the validator using DNS rebinding or HTTP redirects to access cloud metadata endpoints, internal services, or read arbitrary local files on default installations.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-18T12:19:34.890Z",
  "pubdate": "2026-08-18T12:19:34.890Z",
  "executiveSummary": "ArcadeDB versions before 26.8.1 contain a severe server-side request forgery (SSRF) vulnerability residing within the IMPORT DATABASE command. This flaw allows authenticated attackers to bypass security validation mechanisms through advanced networking techniques such as DNS rebinding or HTTP redirects.\nThe vulnerability compromises the confidentiality and integrity of the hosting infrastructure by granting unauthorized access to sensitive internal resources. Successful exploitation enables threat actors to query cloud metadata endpoints, interact with internal microservices, or read arbitrary local files directly from default installations.\nThe attack vector requires authentication to issue the crafted IMPORT DATABASE command, lowering the barrier for internal adversaries or compromised user accounts. The core issue stems from a validation discrepancy where the initial hostname resolution performed by the security validator differs from the subsequent connection phase.\nOrganizations running vulnerable instances face significant risk implications, including potential data exfiltration and pivot capabilities into restricted internal network segments. Immediate remediation requires updating ArcadeDB to version 26.8.1 or later to enforce strict URL validation and prevent unauthorized redirection during database import operations.",
  "technicalDetails": "The root cause of the vulnerability lies in a logic discrepancy between the security validation phase and the subsequent connection execution phase within the IMPORT DATABASE command handler. When a database import is initiated, the application security validator resolves and inspects the target hostname to ensure compliance with security policies.\nHowever, during the actual connection establishment, the underlying HTTP or network client re-resolves the raw URL and automatically follows HTTP redirects without re-applying the security validation checks to the newly resolved destination.\nThis architectural flaw enables attackers to employ DNS rebinding techniques, where a malicious DNS server returns a safe IP address during the initial validation check and instantly swaps it for an internal IP address, loopback address, or cloud metadata service IP during the subsequent connection attempt.\nAlternatively, attackers can supply a URL pointing to an attacker-controlled HTTP server that issues a redirect (such as HTTP 302) to restricted internal endpoints like 169.254.169.254 for cloud metadata, localhost services, or local file retrieval URIs such as file:// protocols depending on parser capabilities.\nExploitation requires the attacker to possess valid authentication credentials to execute the IMPORT DATABASE command on the server. The vulnerable component is the database import subsystem of ArcadeDB affecting versions prior to 26.8.1 on default installations.\nThe attack flow proceeds as follows: First, the authenticated attacker crafts a malicious IMPORT DATABASE command specifying a targeted external URL designed to trigger DNS rebinding or redirect responses. Second, the ArcadeDB security validator intercepts the URL, resolves the initial hostname, and validates the IP address against allowed patterns, successfully passing the check. Third, the application proceeds to execute the connection, where the raw URL is re-resolved or redirected to a sensitive internal resource. Fourth, the server establishes a connection to the unintended internal target, processes the response, and potentially exposes sensitive metadata, internal application data, or arbitrary local files back to the attacker."
}