CVE-2026-119575
Last modified
CVE-2026-119575 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. ArcadeDB from 26.8.1 before 26.10.2 contains a server-side request forgery vulnerability that allows authenticated users with updateDatabaseSettings to disable the LOAD CSV IP block list via ALTER DATABASE. Attackers can set arcadedb.opencypher.loadCsv.blockedIpRanges to an empty string, then issue LOAD CSV requests to read cloud metadata and internal loopback or private services..
Description
ArcadeDB from 26.8.1 before 26.10.2 contains a server-side request forgery vulnerability that allows authenticated users with updateDatabaseSettings to disable the LOAD CSV IP block list via ALTER DATABASE. Attackers can set arcadedb.opencypher.loadCsv.blockedIpRanges to an empty string, then issue LOAD CSV requests to read cloud metadata and internal loopback or private services.
Metrics
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-119575?
How severe is CVE-2026-119575?
How do I fix CVE-2026-119575?
How Strix Helps
- One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-119569Parse Server before 8.6.108 and 9.0.0 before 9.10.5-alpha.9 …5.3
- CVE-2026-119570Parse Server from 9.7.0 before 9.10.5-alpha.7 contains an in…3.1
- CVE-2026-119571Parse Server from 9.7.0 before 9.10.5-alpha.10 contains an a…3.7
- CVE-2026-119572Traefik from 3.7.0-ea.1 before 3.7.15 contains an authentica…8.7
- CVE-2026-119573Traefik 3.7.11 before 3.7.15 contains an authorization bypas…4.4
- CVE-2026-119574Traefik from 3.2.0 before 3.7.15 contains a data race in the…5.9
- CVE-2026-119576ArcadeDB from 21.12.1 before 26.10.2 contains an authorizati…4.3
- CVE-2026-119577ArcadeDB before 26.10.2 contains an improper authorization v…6.8
- CVE-2026-119578MONAI from 1.6.0 before 1.6.1 contains a remote code executi…7.8
- CVE-2026-11958Local privilege escalation by loading DLLs from a shared tem…7.3
- CVE-2026-119586SQLite command-line shell through 3.54.1 contains a command …7.8
- CVE-2026-11959Stored Cross-Site Scripting (XSS) in FacturaScripts, version…6.9
Are you affected by CVE-2026-119575?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST