Basekick-Labs

GHSA-M3QR-FVP4-78XJ: GHSA-m3qr-fvp4-78xj: Authentication Bypass and Log Disclosure in Basekick Labs Arc GHSA-m3qr-fvp4-78xj: Authentication Bypass and Log Disclosure in Basekick Labs Arc > Vulnerability ID: GHSA-M3QR-FVP4-78XJ > CVSS Score: 5.3 > Published: 2026-11-03 GHSA-m3qr-fvp4-78xj is an authentication bypass and information disclosure vulnerability in Arc, an open-source, SQL-native time-series database developed by Basekick Labs and written in Go. Due to an improper route registration sequence within the Go Fiber HTTP server initialization pipeline, the application registered the /api/v1/logs endpoint prior to mounting the global authentication middleware. Because Fiber evaluates route handlers in strict declaration order and terminates request traversal when a handler returns without invoking c.Next(), unauthenticated remote callers can query the logs endpoint and retrieve up to 10,000 buffered operational log entries even when authentication is enabled. TL;DR An authentication bypass in Basekick Labs Arc prior to version v26.06.2 allows unauthenticated remote attackers to read internal application logs via GET /api/v1/logs because the route was registered on the Go Fiber router before the global authentication middleware. --- ⚠️ Exploit Status: POC Technical Details - Advisory ID: GHSA-m3qr-fvp4-78xj - Weakness Class: CWE-306 (Missing Authentication) / CWE-200 (Information Exposure) - Attack Vector: Network (HTTP GET /api/v1/logs) - Severity: Low (CVSS 5.3 - AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) - Affected Component: github.com/basekick-labs/arc (internal/api/server.go, cmd/arc/main.go) - Patched Version: v26.06.2 (commit bb7d9761ad9801e93837762ff7d37460f1df19dd) - Exploit Status: Proof of Concept (Trivial HTTP GET request) - CISA KEV Status: Not Listed Affected Systems - Basekick Labs Arc (github.com/basekick-labs/arc) - Arc: < v26.06.2 (Fixed in: v26.06.2) Code Analysis Commit: bb7d976 Remove /api/v1/logs from pre-middleware RegisterRoutes() and register it via RegisterLogsRoute() with admin authentication after mounting global auth middleware. diff --git a/internal/api/server.go b/internal/api/server.go index 08079e18..cd33caa1 100644 --- a/internal/api/server.go +++ b/internal/api/server.go @@ -12,6 +12,7 @@ import ( "syscall" "time" + "github.com/basekick-labs/arc/internal/auth" "github.com/basekick-labs/arc/internal/logger" "github.com/basekick-labs/arc/internal/metrics" "github.com/gofiber/fiber/v2" @@ -179,13 +180,27 @@ func (s *Server) RegisterRoutes() { s.app.Get("/api/v1/metrics/endpoints", s.endpointMetricsHandler) s.app.Get("/api/v1/metrics/timeseries/:type", s.timeseriesMetricsHandler) - // Application logs endpoint - s.app.Get("/api/v1/logs", s.logsHandler) + // NOTE: /api/v1/logs is intentionally NOT registered here. } +func (s *Server) RegisterLogsRoute(authManager *auth.AuthManager) { + s.app.Get("/api/v1/logs", withAdminAuth(authManager), s.logsHandler) +} Mitigation Strategies - Upgrade Basekick Labs Arc to version v26.06.2 or later to ensure /api/v1/logs is registered after the global authentication middleware and protected by administrative role checks. - Restrict access to the /api/v1/logs path using a reverse proxy, API gateway, or ingress controller if immediate software patching is not feasible. - Segment network access to the Arc HTTP API listener (default port 8000) so that it is only reachable from trusted internal networks or management hosts. Remediation Steps: 1. Pull the official Basekick Labs Arc release v26.06.2 (or later) binary or container image, or recompile from source at commit bb7d9761ad9801e93837762ff7d37460f1df19dd. 2. Restart the Arc database service and verify that config.Auth.Enabled is set to true in the service configuration. 3. Validate the remediation by executing curl -i http://<arc-host>:8000/api/v1/logs without an Authorization header and confirming that the server returns HTTP 401 Unauthorized. 4. If unable to upgrade immediately, add an explicit location block (e.g., location = /api/v1/logs { deny all; return 403; } in NGINX) to block requests at the perimeter proxy. References - GitHub Security Advisory: GHSA-m3qr-fvp4-78xj - Basekick Labs Vendor Advisory: GHSA-m3qr-fvp4-78xj - Pull Request #506: Fix route registration order for /api/v1/logs - Fix Commit bb7d9761ad9801e93837762ff7d37460f1df19dd - Raw Commit Patch bb7d9761ad9801e93837762ff7d37460f1df19dd - Basekick Labs Arc Release Notes v26.06.2 - OSV API Record: GHSA-m3qr-fvp4-78xj - GitHub Advisory Database Record Source --- Read the full report for GHSA-M3QR-FVP4-78XJ on our website for more details including interactive diagrams and full exploit analysis.