TI-2026-40199 CVE-2026-55678 · GHSA-p378-jp5r-gpgw
Arc: Unauthenticated cluster node admission when `cluster.shared_secret` is unset
Priority HIGH 70
Arc is an open, SQL-native time-series database for telemetry.
Basekick-Labs
Records6All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high4CVSS 7.0–8.9
Exploited now
Basekick-Labs records in CISA KEVNo Basekick-Labs vulnerabilities are listed in CISA KEV.
Records
6 records
TI-2026-83373 CVE-2026-55098 · GHSA-93cm-2v4m-c56c
Cross-database authorization bypass in Arc via DuckDB I/O functions
Priority MEDIUM 62
Arc is an open, SQL-native time-series database for telemetry.
TI-2026-35492 CVE-2026-48050 · GHSA-j93g-rp6m-j32m
Arc: Unauthenticated access to Go debug pprof endpoints leaks runtime state and enables CPU-burn DoS
Priority MEDIUM 46
Arc is an open, SQL-native time-series database for telemetry.
TI-2026-35546 CVE-2026-48106
Missing authentication in Basekick-Labs arc
Priority MEDIUM 41
Arc is an open, SQL-native time-series database for telemetry.
TI-2026-35545 CVE-2026-48105
Path traversal in Basekick-Labs arc
Priority LOW 35
Arc is an open, SQL-native time-series database for telemetry.
TI-2026-35236 CVE-2026-47735 · GHSA-p2j4-c4g6-rpf5
Arc has an authenticated arbitrary local-file read via DuckDB I/O functions that bypasses RBAC table-level checks
Priority LOW 32
Arc is an open, SQL-native time-series database for telemetry.