A high-severity Server-Side Request Forgery vulnerability in ArcadeDB allows authenticated attackers to bypass security controls and interact with internal network resources or cloud metadata services.

The vulnerability is a Server-Side Request Forgery (CWE-918) occurring in the IMPORT DATABASE and server commands. By supplying specific IPv6 transition addresses, an authenticated attacker can force the application to make requests to internal-only endpoints that would otherwise be blocked by the SSRF guard.

The exploitation of this flaw poses a significant risk to internal network segmentation and cloud infrastructure security. An attacker could potentially gain unauthorized access to internal services or extract sensitive cloud metadata credentials, leading to data exfiltration or broader network compromise. Given the CVSS score of 7.7, this is considered a high-risk vulnerability that requires prompt attention to prevent lateral movement within the environment.

Immediate Action: Upgrade to ArcadeDB version 26.9.1 or later immediately to apply the necessary validation logic for IPv6 transition addresses.

Proactive Monitoring: Review application and network access logs for suspicious outbound connections originating from the ArcadeDB server, particularly those targeting internal IP ranges or cloud metadata service addresses (e.g., 169.254.169.254).

Compensating Controls: Implement strict egress filtering on the host machine to restrict outbound traffic to only necessary destinations, effectively preventing the server from reaching internal management endpoints.

Public Exploit Available: No — exploit_available (false).

This vulnerability represents a credible threat to the integrity of internal infrastructure due to the potential for SSRF-based attacks. Security teams should prioritize the update to version 26.9.1 as the primary remediation step. If immediate patching is not feasible, apply restrictive egress firewall rules to the database server to mitigate the impact of potential exploitation.