CVE-2026-93597

{
  "etk_id": "ETK-2026-3525",
  "cve_id": "CVE-2026-93597",
  "display_id": "CVE-2026-93597",
  "ghsa_id": "GHSA-67m7-7w7g-mpmh",
  "euvd_id": "EUVD-2026-82892",
  "status": "published",
  "anchor_state": "anchored",
  "title": "IPv6 transition-address SSRF bypass in arcadedb-engine",
  "summary": "arcadedb-engine before 26.9.1 does not fully screen IPv6 transition addresses when validating URLs for database import and server commands. An authenticated user with import or restore permissions could access internal HTTP services or cloud metadata if they control DNS and the environment can route the relevant IPv6 transition address.",
  "mitigation": "Upgrade com.arcadedb:arcadedb-engine to version 26.9.1 or later. Until upgraded, restrict import and server-command privileges and limit outbound access from ArcadeDB to internal networks and metadata services.",
  "vendor": "maven",
  "product": "maven:com.arcadedb:arcadedb-engine",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "<= 26.8.1"
      ],
      "ecosystem": "maven",
      "fixed_versions": [
        "26.9.1"
      ],
      "package_name": "com.arcadedb:arcadedb-engine",
      "purl": "pkg:maven/com.arcadedb/arcadedb-engine"
    }
  ],
  "cwes": null,
  "cvss_score": 7.7,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 7.24338045,
  "t0_at": "2026-09-18T13:20:08.858000+00:00",
  "signals": {
    "public_poc": {
      "at": "2026-09-03T19:37:00+00:00",
      "days": -14.738296967592593,
      "is_lower_bound": false,
      "measured_at": "2026-09-18T13:20:08.858000+00:00",
      "url": "https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-67m7-7w7g-mpmh"
    },
    "trigger_signal": {
      "at": "2026-09-18T13:20:08.858000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-09-18T13:20:08.858000+00:00",
      "url": "https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-67m7-7w7g-mpmh"
    }
  }
}