What is GHSA-vqh4-vww9-5p94?

GHSA-vqh4-vww9-5p94 is a security advisory published by GitHub Security Advisories with High severity. ArcadeDB from 26.8.1 before 26.10.2 contains a server-side request forgery vulnerability that...

Which CVE IDs does GHSA-vqh4-vww9-5p94 cover?

GHSA-vqh4-vww9-5p94 covers the following CVE IDs: CVE-2026-119575. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-vqh4-vww9-5p94?

GHSA-vqh4-vww9-5p94 has a CVSS v3 base score of 6.5, published by GitHub Security Advisories.

GHSA-vqh4-vww9-5p94HighCVSS 6.5

ArcadeDB from 26.8.1 before 26.10.2 contains a server-side request forgery vulnerability that...

Vendor

GitHub Security Advisories

Published

October 30, 2026

Last Modified

October 30, 2026

🔗 CVE IDs covered (1)

CVE-2026-119575 →

📋 Description

ArcadeDB from 26.8.1 before 26.10.2 contains a server-side request forgery vulnerability that allows authenticated users with updateDatabaseSettings to disable the LOAD CSV IP block list via ALTER DATABASE. Attackers can set arcadedb.opencypher.loadCsv.blockedIpRanges to an empty string, then issue LOAD CSV requests to read cloud metadata and internal loopback or private services.

🔗 References (4)

https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-cc88-w7hj-6h8f
https://nvd.nist.gov/vuln/detail/CVE-2026-119575
https://www.vulncheck.com/advisories/arcadedb-26.8.1-before-26.10.2-ssrf-via-alter-database-load-csv-block-list
https://github.com/advisories/GHSA-vqh4-vww9-5p94