ArcadeDB versions prior to 26.9.1 lack proper validation of IPv6 transition addresses in the SSRF guard used by the IMPORT DATABASE and server commands. An authenticated attacker can craft URLs that resolve to NAT64, 6to4, or Teredo addresses containing RFC 1918 or loopback IPv4 payloads, enabling requests to internal services or cloud metadata endpoints that would otherwise be inaccessible from the external network.

Products affected are ArcadeData’s ArcadeDB database engine for all builds before 26.9.1. The vulnerability is triggered when an authenticated user issues the IMPORT DATABASE or server commands. No specific sub‑versions beyond 26.9.0 are listed, so all releases prior to 26.9.1 are included.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score of 0.00334 (< 1%) indicates a very low likelihood of exploitation. The vulnerability is not yet in the CISA KEV catalog. Attackers need valid authentication and the ability to run administrative commands, but once this is achieved they can reach internal network resources or cloud metadata, potentially exposing sensitive configuration or credentials. The risk is deliberate exploitation rather than widespread random attacks.