CyberRota Analysis
AI-GeneratedArcadeDB versions prior to 26.9.1 are vulnerable due to inadequate validation of IPv6 transition addresses in the SSRF guard, allowing authenticated attackers to exploit this weakness. By supplying specially crafted URLs, they can access internal services and cloud metadata endpoints, potentially leading to unauthorized data exposure. Organizations using affected versions should prioritize patching to mitigate the risk of internal network breaches.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
ArcadeDB versions before 26.9.1 fail to validate IPv6 transition addresses in the SSRF guard used by IMPORT DATABASE and server commands. Authenticated attackers can supply URLs resolving to NAT64, 6to4, or Teredo addresses embedding RFC 1918 or loopback IPv4 payloads to reach internal services and cloud metadata endpoints.