Basekick-Labs

CVE-2026-55098: CVE-2026-55098: Cross-Database Authorization Bypass via DuckDB Table-Valued I/O Functions in Basekick-Labs Arc CVE-2026-55098: Cross-Database Authorization Bypass via DuckDB Table-Valued I/O Functions in Basekick-Labs Arc > Vulnerability ID: CVE-2026-55098 > CVSS Score: 6.5 > Published: 2026-11-04 CVE-2026-55098 (GHSA-93cm-2v4m-c56c) is an authorization bypass and sensitive information disclosure vulnerability in Basekick-Labs Arc prior to version 26.06.2. The flaw stems from an incomplete remediation of CVE-2026-47735, which failed to restrict the full suite of DuckDB table-valued filesystem I/O functions and quoted-identifier invocations. Because Arc's query parser ignores function calls during table reference extraction, authenticated users with minimal or empty permissions can invoke functions like parquet_scan(), glob(), and read_blob() to read, enumerate, and extract telemetry data across all tenant databases residing within the shared local storage root. TL;DR An incomplete denylist in Basekick-Labs Arc prior to v26.06.2 allows any authenticated user to bypass database-level RBAC by invoking unblocked DuckDB filesystem I/O functions (such as parquet_scan and glob) or quoted identifiers, enabling full read access to all tenant databases in the shared storage directory. --- ⚠️ Exploit Status: POC Technical Details - Vulnerability Type: Incorrect Authorization / Cross-Tenant Data Disclosure (CWE-863, CWE-200) - Affected Component: SQL Query Validator (internal/api/query.go) & Token Auth (internal/auth/auth.go) - Attack Vector: Network via authenticated HTTP POST to /api/v1/query - CVSS v3.1 Score: 6.5 Medium (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) - EPSS Score: 0.319% (25.03rd Percentile) - Impact: Unauthorized read access and directory enumeration across all tenant databases in cfg.LocalStorageRoot - Exploit Status: Proof-of-Concept available in repository test suite - Fixed Version: Arc v26.06.2 Affected Systems - Basekick-Labs Arc - Arc: < 26.06.2 (Fixed in: 26.06.2) Code Analysis Commit: 5dc8f53 fix(security): block DuckDB I/O function family in user SQL (GHSA-93cm-2v4m-c56c) (#495) File: internal/api/query.go @@ -2055,41 +2055,115 @@ func ValidateSQLRequest(sql string) error { - if userSQLReadParquetPattern.MatchString(normalised) { - return &SQLValidationError{Message: "Direct read_parquet() calls are not allowed in user SQL"} - } - - if userSQLArcPartitionAggPattern.MatchString(normalised) { - return &SQLValidationError{Message: "Direct arc_partition_agg() calls are not allowed in user SQL"} + ioCheckNormalised := ioDenylistNormalise(sql) + if m := ioTableFunctionPattern.FindStringSubmatch(ioCheckNormalised); m != nil { + return &SQLValidationError{Message: "File I/O function not allowed in user SQL: " + m[1] + "()"} } Exploit Details - GitHub: Regression test suite in internal/api/query_test.go demonstrating cross-database bypass payloads using parquet_scan, glob, read_blob, and quoted identifiers. Mitigation Strategies - Upgrade Basekick-Labs Arc to version 26.06.2 or later to enforce the comprehensive DuckDB I/O function denylist and proper quote normalization. - Audit and rotate API tokens created with empty permission arrays ('permissions': []) prior to v26.06.2, as they were silently granted 'read,write' access. - Deploy Web Application Firewall (WAF) or reverse proxy rules to inspect POST /api/v1/query payloads and reject requests containing DuckDB filesystem table functions. - Isolate sensitive tenants into separate Arc instances with dedicated local storage directories where strict multi-tenant physical separation is required. Remediation Steps: 1. Pull and deploy the Basekick-Labs Arc v26.06.2 release binary or container image (containing commit 5dc8f53b70a3871b16b0cebf328f07c578af7a45). 2. Inspect the authentication token database to identify tokens intended to be RBAC-only that currently possess 'read,write' permissions, and recreate or revoke them. 3. Verify that user SQL queries invoking parquet_scan(), glob(), read_blob(), or quoted variants return a SQLValidationError. References - GitHub Security Advisory GHSA-93cm-2v4m-c56c - Fix Commit 5dc8f53b70a3871b16b0cebf328f07c578af7a45 - Basekick-Labs Arc Pull Request #495 - Basekick-Labs Arc v26.06.2 Release Tag - NVD Detail for CVE-2026-55098 - CVE.org Record for CVE-2026-55098 - CVEListV5 JSON Record for CVE-2026-55098 --- Read the full report for CVE-2026-55098 on our website for more details including interactive diagrams and full exploit analysis.

GHSA-M3QR-FVP4-78XJ: GHSA-m3qr-fvp4-78xj: Authentication Bypass and Log Disclosure in Basekick Labs Arc GHSA-m3qr-fvp4-78xj: Authentication Bypass and Log Disclosure in Basekick Labs Arc > Vulnerability ID: GHSA-M3QR-FVP4-78XJ > CVSS Score: 5.3 > Published: 2026-11-03 GHSA-m3qr-fvp4-78xj is an authentication bypass and information disclosure vulnerability in Arc, an open-source, SQL-native time-series database developed by Basekick Labs and written in Go. Due to an improper route registration sequence within the Go Fiber HTTP server initialization pipeline, the application registered the /api/v1/logs endpoint prior to mounting the global authentication middleware. Because Fiber evaluates route handlers in strict declaration order and terminates request traversal when a handler returns without invoking c.Next(), unauthenticated remote callers can query the logs endpoint and retrieve up to 10,000 buffered operational log entries even when authentication is enabled. TL;DR An authentication bypass in Basekick Labs Arc prior to version v26.06.2 allows unauthenticated remote attackers to read internal application logs via GET /api/v1/logs because the route was registered on the Go Fiber router before the global authentication middleware. --- ⚠️ Exploit Status: POC Technical Details - Advisory ID: GHSA-m3qr-fvp4-78xj - Weakness Class: CWE-306 (Missing Authentication) / CWE-200 (Information Exposure) - Attack Vector: Network (HTTP GET /api/v1/logs) - Severity: Low (CVSS 5.3 - AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) - Affected Component: github.com/basekick-labs/arc (internal/api/server.go, cmd/arc/main.go) - Patched Version: v26.06.2 (commit bb7d9761ad9801e93837762ff7d37460f1df19dd) - Exploit Status: Proof of Concept (Trivial HTTP GET request) - CISA KEV Status: Not Listed Affected Systems - Basekick Labs Arc (github.com/basekick-labs/arc) - Arc: < v26.06.2 (Fixed in: v26.06.2) Code Analysis Commit: bb7d976 Remove /api/v1/logs from pre-middleware RegisterRoutes() and register it via RegisterLogsRoute() with admin authentication after mounting global auth middleware. diff --git a/internal/api/server.go b/internal/api/server.go index 08079e18..cd33caa1 100644 --- a/internal/api/server.go +++ b/internal/api/server.go @@ -12,6 +12,7 @@ import ( "syscall" "time" + "github.com/basekick-labs/arc/internal/auth" "github.com/basekick-labs/arc/internal/logger" "github.com/basekick-labs/arc/internal/metrics" "github.com/gofiber/fiber/v2" @@ -179,13 +180,27 @@ func (s *Server) RegisterRoutes() { s.app.Get("/api/v1/metrics/endpoints", s.endpointMetricsHandler) s.app.Get("/api/v1/metrics/timeseries/:type", s.timeseriesMetricsHandler) - // Application logs endpoint - s.app.Get("/api/v1/logs", s.logsHandler) + // NOTE: /api/v1/logs is intentionally NOT registered here. } +func (s *Server) RegisterLogsRoute(authManager *auth.AuthManager) { + s.app.Get("/api/v1/logs", withAdminAuth(authManager), s.logsHandler) +} Mitigation Strategies - Upgrade Basekick Labs Arc to version v26.06.2 or later to ensure /api/v1/logs is registered after the global authentication middleware and protected by administrative role checks. - Restrict access to the /api/v1/logs path using a reverse proxy, API gateway, or ingress controller if immediate software patching is not feasible. - Segment network access to the Arc HTTP API listener (default port 8000) so that it is only reachable from trusted internal networks or management hosts. Remediation Steps: 1. Pull the official Basekick Labs Arc release v26.06.2 (or later) binary or container image, or recompile from source at commit bb7d9761ad9801e93837762ff7d37460f1df19dd. 2. Restart the Arc database service and verify that config.Auth.Enabled is set to true in the service configuration. 3. Validate the remediation by executing curl -i http://<arc-host>:8000/api/v1/logs without an Authorization header and confirming that the server returns HTTP 401 Unauthorized. 4. If unable to upgrade immediately, add an explicit location block (e.g., location = /api/v1/logs { deny all; return 403; } in NGINX) to block requests at the perimeter proxy. References - GitHub Security Advisory: GHSA-m3qr-fvp4-78xj - Basekick Labs Vendor Advisory: GHSA-m3qr-fvp4-78xj - Pull Request #506: Fix route registration order for /api/v1/logs - Fix Commit bb7d9761ad9801e93837762ff7d37460f1df19dd - Raw Commit Patch bb7d9761ad9801e93837762ff7d37460f1df19dd - Basekick Labs Arc Release Notes v26.06.2 - OSV API Record: GHSA-m3qr-fvp4-78xj - GitHub Advisory Database Record Source --- Read the full report for GHSA-M3QR-FVP4-78XJ on our website for more details including interactive diagrams and full exploit analysis.