CyberRota Analysis
AI-GeneratedArcadeDB versions prior to 26.8.1 are susceptible to a server-side request forgery vulnerability in the IMPORT DATABASE command, allowing authenticated attackers to exploit DNS rebinding or HTTP redirects. This can lead to unauthorized access to sensitive cloud metadata, internal services, or arbitrary local files on default installations. Organizations using ArcadeDB should prioritize patching to mitigate the risk of potential data exposure and unauthorized access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
ArcadeDB versions before 26.8.1 contain a server-side request forgery vulnerability in the IMPORT DATABASE command where the security validator resolves and checks hostnames but the subsequent connection re-resolves the raw URL and follows redirects. Authenticated attackers can bypass the validator using DNS rebinding or HTTP redirects to access cloud metadata endpoints, internal services, or read arbitrary local files on default installations.