Arc: DuckDB I/O aliases bypass database RBAC after CVE-2026-47735

Exploitation

No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.

CVSS

6.5 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS

No dated EPSS signal available.

As published by the source; long descriptions are shortened.

Summary The fix for CVE-2026-47735 (released 2026.06.1) is incomplete. It added a DuckDB sandbox (SET GLOBAL alloweddirectories=[<storage root]; SET GLOBAL enableexternalaccess=false) and an Arc SQL-layer denylist of the literal functions readparquet( and arcpartitionagg(. The sandbox correctly blocks reads outside the storage root (OS files, http:// SSRF), but it allowlists the entire multi-tenant storage root, and the SQL denylist still misses the rest of the DuckDB I/O family the original advisory enumerated. As a result, any authenticated token — including one with permissions: [] — can read or enumerate every other database's data within the deployment, defeating RBAC. Verified at HEAD c08b892 (v26.06.1-36, includes 26.06.2). Confirmed still live; no later commit blocks these functions. Root cause (three composing gaps) 1. Sandbox scope is the whole storage root, not the tenant. internal/database/sandbox.go:111 allowlists cfg.LocalStorageRoot (default…

Published by the source

4 Nov 2026, 17:02 UTC

Last modified by the source

4 Nov 2026, 17:02 UTC

Source last checked

4 Nov 2026, 18:00 UTC

1. Revision 1 · created · 4 Nov 2026

   Published from ghsa record GHSA-93cm-2v4m-c56c

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: CVE-2026-55098

Advisory: Arc: DuckDB I/O aliases bypass database RBAC after CVE-2026-47735
IDs: CVE-2026-55098, GHSA-93cm-2v4m-c56c
Record: https://patchnext.com/advisories/cve-2026-55098 (revision 1, source checked 4 Nov 2026, 18:00 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: Medium (CVSS 6.5)
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Vendor fix available; fixed versions by package: github.com/basekick-labs/arc 0.0.0-20260610131716-5dc8f53b70a3. A vendor fix does not mean a deployment is fixed.

## Affected components
- Go github.com/basekick-labs/arc: affected < 0.0.0-20260610131716-5dc8f53b70a3; fixed in 0.0.0-20260610131716-5dc8f53b70a3

## Suggested inspection (read-only)
- Go github.com/basekick-labs/arc: check the installed version with your package manager.

## Supported action
Upgrade each affected component to a fixed version on its release line. For a transitive dependency, upgrade the parent package or add an override or constraint, then regenerate the lockfile. Redeploy every environment that ran an affected version.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on github.com/basekick-labs/arc.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://github.com/advisories/GHSA-93cm-2v4m-c56c (GitHub-reviewed advisory GHSA-93cm-2v4m-c56c lists affected ranges: Go github.com/basekick-labs/arc >=0 <0.0.0-20260610131716-5dc8f53b70a3)

Commands are suggestions: review each one before running it.