ArcadeDB versions prior to 26.8.1 contain an SSRF flaw in the IMPORT DATABASE command. The command validates hostnames but the subsequent connection re‑resolves the raw URL and follows redirects. Authenticated users can exploit this by using DNS rebinding or HTTP redirects to point the database at cloud metadata endpoints, internal services, or to read arbitrary local files on the default installation. This vulnerability is classified as CWE‑918 and can lead to unauthorized data exposure and potential compromise of internal resources.

ArcadeData’s ArcadeDB, any instance running version 26.8.0 or earlier. The affected component is the server-side IMPORT DATABASE feature, which is only available to authenticated users with database privileges.

The CVSS score is 7.1, indicating a high severity risk. No EPSS score is currently available, and the vulnerability is not listed in the CISA KEV catalog. Attack requires authentication to the database server, so exposed databases or those that grant administrative privileges pose the greatest threat. The vulnerability allows bypass of the hostname validator via DNS rebinding or redirects, enabling attackers to trigger arbitrary outbound requests from the server.