Read the docs
TI-2026-35236 Aliases CVE-2026-47735GHSA-p2j4-c4g6-rpf5

Arc has an authenticated arbitrary local-file read via DuckDB I/O functions that bypasses RBAC table-level checks

Priority LOW 32CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-200.

Summary

Arc is an open, SQL-native time-series database for telemetry. Prior to version 26.06.1, Arc's user-SQL validator (`internal/api/query.go:ValidateSQLRequest`) blocked only `read_parquet(` and `arc_partition_agg(` via regex denylist. The broader DuckDB I/O function family — `read_csv_auto`, `read_csv`, `read_json`, `read_json_auto`, `read_text`, `read_blob`, `glob`, `parquet_metadata`, `parquet_schema`, `read_xlsx`, etc. — was not blocked. RBAC table-reference extraction inspected only `FROM`/`JOIN` clauses, so scalar table functions in the `SELECT` list slipped past both layers. This is fixed in 2026.06.1 via a structural sandbox at the DuckDB layer. After lockdown, DuckDB refuses to open any file outside the allowlist and refuses further `INSTALL`/`LOAD`. Already-loaded extensions remain callable. Some workarounds are available. Restrict API access to known-trusted networks via firewall rules or, as a temporary mitigation, add `read_csv*`/`read_json*`/`glob` etc. to `dangerousSQLPattern` in `internal/api/query.go`.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00431 37th percentileScored 2026-11-07
Fix Fixed arc (Basekick-Labs): 2026.06.1github.com/basekick-labs/arc (Go): 0.0.0-20260520141557-91bdc29d1a02

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Basekick-Labsarcbefore 2026.06.12026.06.1Patch availableCNA
—github.com/basekick-labs/arc (Go)before 0.0.0-20260520141557-91bdc29d1a020.0.0-20260520141557-91bdc29d1a02Patch availableGHSA-p2j4-c4g6-rpf5
  • arc VendorBasekick-Labs Affected before 2026.06.1 Fixed in 2026.06.1 Patch available CNA
  • github.com/basekick-labs/arc (Go) Vendor— Affected before 0.0.0-20260520141557-91bdc29d1a02 Fixed in 0.0.0-20260520141557-91bdc29d1a02 Patch available GHSA-p2j4-c4g6-rpf5

Remediation

  • Fix · CNA arc (Basekick-Labs) Fixed in 2026.06.1
  • Fix · GHSA-p2j4-c4g6-rpf5 github.com/basekick-labs/arc (Go) Fixed in 0.0.0-20260520141557-91bdc29d1a02 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-47735
  2. 2026-10-03 Alias added: GHSA-p2j4-c4g6-rpf5

References

Other 5

  • TI-2026-40199 Arc: Unauthenticated cluster node admission when `cluster.shared_secret` is unset CVSS 4.0MEDIUM 6.9
  • TI-2026-83373 Cross-database authorization bypass in Arc via DuckDB I/O functions CVSS 3.1MEDIUM 6.5
  • TI-2026-35492 Arc: Unauthenticated access to Go debug pprof endpoints leaks runtime state and enables CPU-burn DoS CVSS 4.0HIGH 8.8
  • TI-2026-35546 Missing authentication in Basekick-Labs arc CVSS 4.0HIGH 8.3
  • TI-2026-35545 Path traversal in Basekick-Labs arc CVSS 4.0HIGH 8.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences