What is GHSA-9fpr-24pp-pfx2?

GHSA-9fpr-24pp-pfx2 is a security advisory published by GitHub Security Advisories with Medium severity. ArcadeDB versions before 26.9.1 fail to validate IPv6 transition addresses in the SSRF guard used...

Which CVE IDs does GHSA-9fpr-24pp-pfx2 cover?

GHSA-9fpr-24pp-pfx2 covers the following CVE IDs: CVE-2026-93597. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-9fpr-24pp-pfx2?

GHSA-9fpr-24pp-pfx2 has a CVSS v3 base score of 7.7, published by GitHub Security Advisories.

GHSA-9fpr-24pp-pfx2MediumCVSS 7.7

ArcadeDB versions before 26.9.1 fail to validate IPv6 transition addresses in the SSRF guard used...

Vendor

GitHub Security Advisories

Published

September 18, 2026

Last Modified

September 18, 2026

🔗 CVE IDs covered (1)

CVE-2026-93597 →

📋 Description

ArcadeDB versions before 26.9.1 fail to validate IPv6 transition addresses in the SSRF guard used by IMPORT DATABASE and server commands. Authenticated attackers can supply URLs resolving to NAT64, 6to4, or Teredo addresses embedding RFC 1918 or loopback IPv4 payloads to reach internal services and cloud metadata endpoints.

🔗 References (4)

https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-67m7-7w7g-mpmh
https://nvd.nist.gov/vuln/detail/CVE-2026-93597
https://www.vulncheck.com/advisories/arcadedb-before-26.9.1-ssrf-via-ipv6-transition-addresses
https://github.com/advisories/GHSA-9fpr-24pp-pfx2