CVE-2026-93597
Last modified
CVE-2026-93597 is a high-severity vulnerability rated 7.7/10 on the CVSS scale. ArcadeDB versions before 26.9.1 fail to validate IPv6 transition addresses in the SSRF guard used by IMPORT DATABASE and server commands. Authenticated attackers can supply URLs resolving to NAT64, 6to4, or Teredo addresses embedding RFC 1918 or loopback IPv4 payloads to reach internal services and cloud metadata endpoints..
Description
ArcadeDB versions before 26.9.1 fail to validate IPv6 transition addresses in the SSRF guard used by IMPORT DATABASE and server commands. Authenticated attackers can supply URLs resolving to NAT64, 6to4, or Teredo addresses embedding RFC 1918 or loopback IPv4 payloads to reach internal services and cloud metadata endpoints.
Metrics
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-93597?
How severe is CVE-2026-93597?
How do I fix CVE-2026-93597?
How Strix Helps
- One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-93591SiYuan versions before 3.8.3 contain an SQL injection vulner…7.6
- CVE-2026-93592vLLM versions before 0.28.0 fail to validate the lower bound…7.5
- CVE-2026-93593ArcadeDB before 26.9.1 fails to enforce security-group types…8.1
- CVE-2026-93594ArcadeDB (Maven artifact com.arcadedb:arcadedb-engine) throu…8.1
- CVE-2026-93595ArcadeDB before 26.9.1 contains an access control bypass vul…6.5
- CVE-2026-93596ArcadeDB before 26.9.1 (com.arcadedb:arcadedb-engine <= 26.8…4.3
- CVE-2026-93598ArcadeDB (Maven artifact com.arcadedb:arcadedb-engine) throu…7.1
- CVE-2026-93599rustls-webpki through 0.103.12 (and 0.104.0-alpha releases b…7.5
- CVE-2026-9360A security flaw has been discovered in Edimax EW-7438RPn 1.2…8.8
- CVE-2026-93600rustls-webpki (rustls/webpki) versions 0.101.0 through 0.103…2.2
- CVE-2026-93601rustls-webpki (the Rust webpki fork used by rustls) versions…2.2
- CVE-2026-93602rustls-webpki versions before 0.103.10 and 0.104.0-alpha.5 c…4.4
Are you affected by CVE-2026-93597?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST