Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
5 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Go github.com/basekick-labs/arc < 0.0.0-20260610131716-5dc8f53b70a3
Fixed in
0.0.0-20260610131716-5dc8f53b70a3· Vendor fix available
Issue
The fix for CVE-2026-47735 (released 2026.06.1) is incomplete. It added a DuckDB sandbox (SET GLOBAL alloweddirectories=[<storage root]; SET GLOBAL enableexternalaccess=false) and an Arc SQL-layer denylist of the literal functions readparquet( and arcpartitionagg(. The sandbox correctly blocks reads outside the storage root (OS files, http:// SSRF), but it allowlists the entire multi-tenant storage root, and the SQL denylist still misses the rest of the DuckDB I/O family the original advisory enumerated. As a result, any authenticated token — including one with permissions: [] — can read or enumerate every other database's data within the deployment, defeating RBAC. Verified at HEAD c08b892 (v26.06.1-36, includes 26.06.2). Confirmed still live; no later commit blocks these functions. Root cause (three composing gaps) 1. Sandbox scope is the whole storage root, not the tenant. internal/database/sandbox.go:111 allowlists cfg.LocalStorageRoot (default…
Recommended action: Upgrade to 0.0.0-20260610131716-5dc8f53b70a3 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/basekick-labs/arc < 0.0.0-20260615165136-bb7d9761ad98
Fixed in
0.0.0-20260615165136-bb7d9761ad98· Vendor fix available
Issue
Arc exposes `GET /api/v1/logs` without authentication even when authentication is enabled by default. The route is registered before the global Fiber authentication middleware, and the handler returns recent buffered application logs without performing its own authorization check. Details Arc applies the global auth middleware after calling `server.RegisterRoutes()`: - `cmd/arc/main.go:1598-1599` registers base routes via `server.RegisterRoutes()`. - `cmd/arc/main.go:1601-1618` configures and installs `auth.NewMiddleware(...)` later. `server.RegisterRoutes()` registers `GET /api/v1/logs` as a base route: - `internal/api/server.go:164-183` registers base health, metrics, and logs routes, including `s.app.Get("/api/v1/logs", s.logsHandler)`. The logs handler returns buffered logs without checking authentication or authorization: - `internal/api/server.go:537-567` parses `limit`, `level`, and `since_minutes`, reads `logger.GetBuffer().GetRecent(...)`, and returns JSON. -…
Recommended action: Upgrade to 0.0.0-20260615165136-bb7d9761ad98 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/basekick-labs/arc < 0.0.0-20260615160325-38402ad2ebdd
Fixed in
0.0.0-20260615160325-38402ad2ebdd· Vendor fix available
Issue
Arc Enterprise clustering accepts cluster join requests without authentication when cluster.enabled=true but cluster.sharedsecret is not configured. The coordinator validates HMAC authentication only if a shared secret is non-empty; otherwise, a network attacker who can reach the coordinator port can send a join request with attacker-controlled node addresses and role. Accepted nodes are marked healthy, registered locally or added as Raft voters, and can be selected by the cluster router for forwarded authenticated requests. Details Cluster defaults include an empty shared secret and TLS disabled: - internal/config/config.go:943-950 defaults cluster.enabled=false, cluster.clustername="arc-cluster", and cluster.coordinatoraddr=":9100". - internal/config/config.go:1001-1005 defaults cluster.sharedsecret="" and cluster.tlsenabled=false. Startup requires a shared secret only for file replication, not for all clustering/join/routing use: - cmd/arc/main.go:1258-1265 hard-fails…
Recommended action: Upgrade to 0.0.0-20260615160325-38402ad2ebdd (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/basekick-labs/arc < 0.0.0-20260520170331-32a4091fb949
Fixed in
0.0.0-20260520170331-32a4091fb949· Vendor fix available
Issue
Arc registers Go's net/http/pprof handlers at /debug/pprof/ via app.Use(pprof.New()) in internal/api/server.go, and /debug/pprof is added to PublicPrefixes in cmd/arc/main.go. The auth middleware short-circuits before the token check on prefix match, so the endpoints are reachable without any authentication. Impact Any network-reachable caller (no token required) can: - Fetch /debug/pprof/heap — leaks in-memory state: live SQL strings, decoded msgpack records, decompressed request bodies, cached TokenInfo (the auth cache keys on SHA-256 of the plaintext token at auth.go:543). - Fetch /debug/pprof/goroutine?debug=2 — leaks call stacks, identifying internal code paths. - Fetch /debug/pprof/profile?seconds=N — pins a CPU core for arbitrary duration. Trivial DoS amplification (one short HTTP request → minutes of server CPU). - Fetch /debug/pprof/trace — long-duration execution trace, similar DoS profile. No authentication, no rate limiting, no resource bound on the seconds…
Recommended action: Upgrade to 0.0.0-20260520170331-32a4091fb949 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/basekick-labs/arc < 0.0.0-20260520141557-91bdc29d1a02
Fixed in
0.0.0-20260520141557-91bdc29d1a02· Vendor fix available
Issue
Arc's user-SQL validator (internal/api/query.go:ValidateSQLRequest) blocked only readparquet( and arcpartitionagg( via regex denylist. The broader DuckDB I/O function family — readcsvauto, readcsv, readjson, readjsonauto, readtext, readblob, glob, parquetmetadata, parquetschema, readxlsx, etc. — was not blocked. RBAC table-reference extraction inspected only FROM/JOIN clauses, so scalar table functions in the SELECT list slipped past both layers. Impact Any authenticated user, including a token with permissions: [], can read arbitrary local files via: Confirmed reachable targets: - auth.db — bcrypt hashes for every API token, plus legacy SHA-256 rows. - arc.toml — S3 secrets, TLS keys. - /proc/self/environ — environment-variable secrets. - Cross-tenant Parquet files — bypasses RBAC because the tenant scope is enforced at the table layer, not on raw file paths. - SSRF when httpfs is loaded (any S3-backed deployment) — readcsvauto('http://169.254.169.254/latest/meta-data/...')…
Recommended action: Upgrade to 0.0.0-20260520141557-91bdc29d1a02 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.