Description

ArcadeDB before 26.8.1 contains a server-side request forgery vulnerability in the OpenCypher LOAD CSV implementation that fails to validate HTTP/HTTPS URLs. Authenticated attackers can craft LOAD CSV queries pointing to internal network addresses or cloud metadata endpoints to make the ArcadeDB server fetch and return sensitive data from restricted services.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.7",
  "pubDate": "2026-08-19T14:17:49.020Z",
  "pubdate": "2026-08-19T14:17:49.020Z",
  "executiveSummary": "ArcadeDB before 26.8.1 suffers from a server-side request forgery (SSRF) vulnerability residing within the OpenCypher LOAD CSV implementation. The underlying flaw stems from the application's failure to adequately validate or restrict HTTP and HTTPS URLs supplied during query execution. Consequently, authenticated malicious actors can construct specialized LOAD CSV queries designed to target internal network resources, private subnet infrastructures, or sensitive cloud metadata endpoints. Upon execution, the vulnerable ArcadeDB server processes these arbitrary URLs, fetching resources from the internal targets and potentially returning sensitive data back through the query response or leaking internal service states. This exposes organizations to severe risks, including internal network reconnaissance, unauthorized data exfiltration, and potential interaction with restricted administrative interfaces residing behind the network perimeter. Exploitation of this vulnerability requires prior authentication to the database server, allowing the attacker to interact with the query execution engine. Organizations deploying affected versions must apply the necessary software updates to enforce strict URL validation protocols and restrict outbound network access from the database server.",
  "technicalDetails": "The vulnerability is localized within the OpenCypher query language implementation of ArcadeDB, specifically inside the feature handling the LOAD CSV command. The root cause of the flaw is the complete absence of input validation and sanitization mechanisms for HTTP and HTTPS URLs provided as parameters or arguments to the data loading functionality. Normally, such features are expected to enforce strict allowlisting of permitted domains, validate IP address ranges to block internal routing, or prohibit dangerous URI schemes altogether. Because ArcadeDB fails to implement these defensive checks, it blindly accepts user-supplied URLs and utilizes its internal HTTP client libraries to initiate outbound web requests to the specified targets.\nThe exploitation lifecycle begins with an authenticated attacker gaining access to an interface capable of submitting OpenCypher queries to the ArcadeDB server. The attacker crafts a malicious OpenCypher statement leveraging the vulnerable LOAD CSV syntax, replacing the intended external data source URI with an internal target. Examples of internal targets include RFC 1918 private IP addresses, localhost services, or cloud provider metadata service endpoints (such as AWS, GCP, or Azure metadata APIs).\nOnce the crafted query is submitted, the ArcadeDB query parser processes the LOAD CSV instruction and hands the raw URL to the underlying network fetching component. The server then initiates an outbound HTTP or HTTPS connection from the host running the database instance to the targeted internal service. Because the server itself establishes this connection, it bypasses network-level firewalls that would normally block external entities from reaching internal systems. The remote internal service processes the request, potentially returning sensitive internal data, configuration files, environment variables, or cloud credentials back to the ArcadeDB process. Depending on how the OpenCypher implementation handles the retrieved payload, the sensitive data may be reflected back to the attacker in the query execution results or error outputs, facilitating unauthorized data exfiltration.\nThe affected component is the OpenCypher LOAD CSV implementation in ArcadeDB versions prior to 26.8.1. The attack vector requires network exposure of the database management interface, valid authentication credentials to execute queries, and low privilege requirements depending on the configuration of database roles. The behavior of the payload directly abuses the server's outbound networking capabilities to pivot from the database tier into restricted internal segments of the enterprise architecture."
}