ArcadeDB versions 26.8.1 through 26.10.2 allow authenticated users who possess updateDatabaseSettings privileges to disable the LOAD CSV IP block list. By setting arcadedb.opencypher.loadCsv.blockedIpRanges to an empty string and then issuing a LOAD CSV command, an attacker can force the database server to make outbound requests to arbitrary URLs, including cloud metadata endpoints, local loopback addresses, or other private services. This vulnerability enables the attacker to read data that should be restricted to the internal network, effectively leaking sensitive information and potentially discovering internal services.

ArcadeData ArcadeDB 26.8.1 through the pre‑26.10.2 releases are affected. Supervisors, team leads, and support staff are recommended to verify the exact version installed in their environments and to seek an upgrade.

The vulnerability has a CVSS score of 7.1 and no EPSS score is available, indicating moderate to high severity but uncertain exploitation probability. It is not listed in CISA’s KEV catalog. Exploitation requires authenticated access with updateDatabaseSettings permissions and the ability to issue ALTER DATABASE commands. Once the block list is cleared, the attacker can trigger SSRF and read privileged internal resources.