ArcadeDB IMPORT DATABASE Allows SSRF and Arbitrary Local File Read

A high-severity vulnerability (CVE-2026-54077) in ArcadeDB versions prior to 26.6.1 allows authenticated users to perform Server-Side Request Forgery (SSRF) and arbitrary local file reads. The flaw exists in the IMPORT DATABASE SQL statement, which did not require administrative privileges and failed to validate the source URL provided to its importer. This allows any authenticated user with SQL command access, not just root or administrators, to force the ArcadeDB server to make HTTP(S) requests to arbitrary internal and external destinations, including cloud metadata endpoints (e.g., 169.254.169.254). Attackers can also leverage file:// paths to read sensitive local files, such as /etc/passwd or credential files, which are then ingested as queryable database records. The issue is critical as it enables information disclosure, internal network reconnaissance, and potential lateral movement from a compromised authenticated user account within an ArcadeDB deployment.

Attack Chain

1. An authenticated user with SQL command access connects to the ArcadeDB server's SQL command/query endpoints (/api/v1/command, /api/v1/query).
2. The user crafts and executes an IMPORT DATABASE SQL statement specifying a target URL or file path.
3. To achieve Server-Side Request Forgery (SSRF), the user provides an HTTP(S) URL pointing to an internal service or a cloud metadata endpoint (e.g., http://169.254.169.254/latest/meta-data/).
4. The ArcadeDB server executes the IMPORT DATABASE statement, making an unvalidated outbound HTTP(S) request to the specified URL.
5. The server ingests the HTTP response content from the internal service or cloud metadata endpoint into a database record, allowing the attacker to query the retrieved information.
6. Alternatively, to achieve arbitrary local file read, the user provides a file:// path to a sensitive system file (e.g., file:///etc/passwd, /etc/shadow, or credential files).
7. The ArcadeDB server executes the IMPORT DATABASE statement, attempting to read the local file without proper path validation.
8. The server ingests the file's content into a database record, enabling the authenticated attacker to retrieve and view the sensitive data.

Impact

Successful exploitation of CVE-2026-54077 allows authenticated users to bypass security controls, gaining unauthorized access to internal network resources and sensitive local files residing on the ArcadeDB server. This can lead to significant information disclosure, including cloud instance metadata, internal service configurations, and system-level credentials. Any organization using vulnerable versions of ArcadeDB is at risk, particularly if untrusted users have SQL query access or if the server is deployed in an environment with access to sensitive internal networks or cloud APIs. The consequences of this data exposure could include unauthorized data exfiltration, lateral movement within the network, or further exploitation of exposed internal services.

Recommendation

• Patch CVE-2026-54077 by upgrading ArcadeDB to version 26.6.1 or later immediately.
• Restrict SQL command/query access in ArcadeDB to only trusted administrative users, as specified in the workarounds section of the advisory.
• Deploy the provided Sigma rules to your SIEM and tune them for your environment, especially regarding the specific process identity of your ArcadeDB instance, to detect suspicious network connections and file access.