Vulnerability · Published Sep 18, 2026 · Assigned by VulnCheck
CVE-2026-93597ArcadeDB before 26.9.1 SSRF via IPv6 transition addresses
High 7.7
In plain English
A high-severity server-side request forgery in arcadedb from ArcadeData. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities).
Severity (CVSS 3.1)7.7High
Exploit odds (30 days)0.4%top 70.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
ArcadeDB versions before 26.9.1 fail to validate IPv6 transition addresses in the SSRF guard used by IMPORT DATABASE and server commands. Authenticated attackers can supply URLs resolving to NAT64, 6to4, or Teredo addresses embedding RFC 1918 or loopback IPv4 payloads to reach internal services and cloud metadata endpoints.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| ArcadeData | arcadedb | 0 – before 26.9.1 |
Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
References
- GitHub Security Advisory (GHSA-67m7-7w7g-mpmh) vendor-advisory
- VulnCheck Advisory: ArcadeDB before 26.9.1 SSRF via IPv6 transition addresses third-party-advisory