PkgSeer

Vulnerability GO-2026-5523

Unknown

4 months ago

Arc has an authenticated arbitrary local-file read via DuckDB I/O functions that bypasses RBAC table-level checks in github.com/basekick-labs/arc

<0.0.0-20260520141557-91bdc29d1a02

Summary

Arc has an authenticated arbitrary local-file read via DuckDB I/O functions that bypasses RBAC table-level checks in github.com/basekick-labs/arc

Details

Arc has an authenticated arbitrary local-file read via DuckDB I/O functions that bypasses RBAC table-level checks in github.com/basekick-labs/arc

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

Arc has unauthenticated application log disclosure via `/api/v1/logs`

<0.0.0-20260615165136-bb7d9761ad98 GHSA-m3qr-fvp4-78xj

arc has unauthenticated cluster node admission when `cluster.shared_secret` is unset in github.com/basekick-labs/arc

<0.0.0-20260615160325-38402ad2ebdd GO-2026-6322

arc has unauthenticated cluster node admission when `cluster.shared_secret` is unset

<0.0.0-20260615160325-38402ad2ebdd GHSA-p378-jp5r-gpgw

Arc: Unauthenticated access to Go debug pprof endpoints leaks runtime state and enables CPU-burn DoS in github.com/basekick-labs/arc

<0.0.0-20260520170331-32a4091fb949 GO-2026-5457

Arc: Unauthenticated access to Go debug pprof endpoints leaks runtime state and enables CPU-burn DoS

<0.0.0-20260520170331-32a4091fb949 GHSA-j93g-rp6m-j32m

View all vulnerabilities for these packages

Impacted packages

github.com/basekick-labs/arc

Timeline

Published

4 months ago

Fixed (v0.0.0-20260520141557-91bdc29d1a02)

5 months ago

Last Modified

4 months ago