High severity · published Sep 18, 2026
CVE-2026-93597
ArcadeDB before 26.9.1 SSRF via IPv6 transition addresses
7.7
CVSS
0.4%
EPSS
No
On KEV
Description
ArcadeDB versions before 26.9.1 fail to validate IPv6 transition addresses in the SSRF guard used by IMPORT DATABASE and server commands. Authenticated attackers can supply URLs resolving to NAT64, 6to4, or Teredo addresses embedding RFC 1918 or loopback IPv4 payloads to reach internal services and cloud metadata endpoints.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 29% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AR
arcadedb · ArcadeData
before 26.9.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-93597
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-93597
github.com
https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-67m7-7w7g-mpmh
www.vulncheck.com
https://www.vulncheck.com/advisories/arcadedb-before-26.9.1-ssrf-via-ipv6-transition-addresses
More from arcadedb
9.9
CVE-2026-75851
ArcadeDB before 26.8.1 Authentication Bypass via Async Command
9.9
CVE-2026-75843
ArcadeDB before 26.8.1 Privilege Escalation via gRPC Transaction
9.8
CVE-2026-75854
ArcadeDB Redis Wire-Protocol Plugin Missing Authentication
9.8
CVE-2026-75852
ArcadeDB MongoDB wire protocol authentication bypass cross-database
9.8
CVE-2026-67341
ArcadeDB before 26.7.2 Authorization Bypass via SQL DEFINE FUNCTION