CVE-2026-75842 ArcadeData CVE debrief

Who should care

Defenders and administrators of ArcadeDB instances should assess exposure and prioritize mitigation. This includes reviewing and restricting read query privileges, monitoring for suspicious activity, and verifying patch application. Security teams and vulnerability management teams should also be aware of the potential impact and take necessary actions to protect their systems.

Why it matters

CVE-2026-75842 is a high-severity vulnerability in ArcadeDB that allows authenticated users to read arbitrary files. Defenders should prioritize patching, restricting access, and monitoring for suspicious activity.

• Potential data exfiltration through query responses
• Possible unauthorized access to sensitive files
• Need for verification of patch application and access controls
• Potential for misuse by authenticated users with read query privileges

Technical summary

ArcadeDB versions before 26.8.1 contain an arbitrary file read vulnerability in the OpenCypher LOAD CSV FROM clause. Authenticated users with read query privileges can use the file:// protocol in LOAD CSV statements to access arbitrary files with server process privileges, potentially leading to sensitive data exfiltration. The vulnerability allows attackers to access local files, and defenders should prioritize verifying and mitigating this vulnerability in ArcadeDB instances, especially those with read query privileges exposed.

Defensive priority

Defenders should prioritize verifying and mitigating this vulnerability in ArcadeDB instances, especially those with read query privileges exposed.

Recommended defensive actions

• Verify ArcadeDB version and apply patch 26.8.1 or later
• Restrict read query privileges for users and roles
• Monitor for suspicious LOAD CSV statements
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the arbitrary file read vulnerability in ArcadeDB versions before 26.8.1. Official sources confirm the vulnerability in the OpenCypher LOAD CSV FROM clause. Evidence is limited to public CVE and NVD information. Defenders should verify patch application, access controls, and monitor for suspicious LOAD CSV statements. The vulnerability allows authenticated users to read local files using the file:// protocol in LOAD CSV statements.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.