ArcadeDB SSRF via DNS Rebinding in Database Import

ArcadeDB versions before 26.8.1 contain a server-side request forgery vulnerability in the IMPORT DATABASE command where the security validator resolves and checks hostnames but the subsequent connection re-resolves the raw URL and follows redirects. Authenticated attackers can bypass the validator using DNS rebinding or HTTP redirects to access cloud metadata endpoints, internal services, or read arbitrary local files on default installations.

Casky was already ahead

This CVE exploits attack patterns that Casky's 331matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

ArcadeDB versions before 26.8.1 contain a server-side request forgery (SSRF) vulnerability in the IMPORT DATABASE command that allows authenticated attackers to bypass security validation through DNS rebinding or HTTP redirects. The vulnerability exploits a critical timing gap: the security validator resolves and checks hostnames during initial validation, but the actual connection re-resolves the raw URL and follows redirects, creating an opportunity for attackers to pivot from approved targets to cloud metadata endpoints, internal services, or local files. This affects organizations running vulnerable ArcadeDB instances with default configurations, particularly those in cloud environments where metadata endpoints are accessible or in networks with internal services exposed to database connections.

Casky's 331 mapped security skills leverage Claude's extended reasoning to detect attack patterns associated with MITRE techniques TA0001 (Initial Access) and TA0006 (Credential Access) by analyzing network traffic anomalies, authentication logs, and request sequences that indicate SSRF exploitation. Practitioners would observe findings showing: (1) authenticated database import requests that deviate between validation and execution phases, (2) suspicious hostname resolution patterns indicating DNS rebinding attempts, (3) unexpected connections to cloud metadata services (169.254.x.x ranges) or internal IP addresses following database import commands, and (4) attempts to access local file:// URIs through the import functionality. These skill detections help security teams identify the reconnaissance and exploitation chain before data exfiltration occurs.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

331 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-75844.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0006

Investigate the attack patterns behind CVE-2026-75844

Casky has 331 skills that investigate the attack patterns behind CVE-2026-75844. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn