SEPTEMBER 19, 2026
Live Feed
Back to database
Case File

CVE-2026-76225

HIGH · CVSS 7.7 EPSS 0.33% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-08-19 · Last synced 2026-09-18

CyberRota Analysis

AI-Generated

ArcadeDB versions prior to 26.8.1 are vulnerable to a server-side request forgery (SSRF) flaw in the OpenCypher LOAD CSV feature, which does not properly validate HTTP/HTTPS URLs. This allows authenticated attackers to manipulate LOAD CSV queries to access internal network addresses or cloud metadata endpoints, potentially exposing sensitive data from restricted services. Organizations using ArcadeDB should prioritize patching to mitigate the risk of data leakage and unauthorized access.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

GitHub PoC Links
github.com ↗

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-76225
Severity
HIGH
CVSS
7.7
EPSS
0.33%

Original NVD Description

ArcadeDB before 26.8.1 contains a server-side request forgery vulnerability in the OpenCypher LOAD CSV implementation that fails to validate HTTP/HTTPS URLs. Authenticated attackers can craft LOAD CSV queries pointing to internal network addresses or cloud metadata endpoints to make the ArcadeDB server fetch and return sensitive data from restricted services.