Vulnerability GO-2026-6913
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
9 hours ago
November 05, 2026 at 10:55 PM UTC
Arc: DuckDB I/O aliases bypass database RBAC after CVE-2026-47735 in github.com/basekick-labs/arc
<0.0.0-20260610131716-5dc8f53b70a3
<0.0.0-20260610131716-5dc8f53b70a3
Summary
Arc: DuckDB I/O aliases bypass database RBAC after CVE-2026-47735 in github.com/basekick-labs/arc
Details
Arc: DuckDB I/O aliases bypass database RBAC after CVE-2026-47735 in github.com/basekick-labs/arc
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Unknown
9 hours ago
Arc has unauthenticated application log disclosure via `/api/v1/logs` in github.com/basekick-labs/arc
<0.0.0-20260615165136-bb7d9761ad98 GO-2026-6907
<0.0.0-20260615165136-bb7d9761ad98 GO-2026-6907
Medium Risk
1 day ago
Arc: DuckDB I/O aliases bypass database RBAC after CVE-2026-47735
<0.0.0-20260610131716-5dc8f53b70a3 GHSA-93cm-2v4m-c56c
<0.0.0-20260610131716-5dc8f53b70a3 GHSA-93cm-2v4m-c56c
Low Risk
2 days ago
Arc has unauthenticated application log disclosure via `/api/v1/logs`
<0.0.0-20260615165136-bb7d9761ad98 GHSA-m3qr-fvp4-78xj
<0.0.0-20260615165136-bb7d9761ad98 GHSA-m3qr-fvp4-78xj
Unknown
2 months ago
arc has unauthenticated cluster node admission when `cluster.shared_secret` is unset in github.com/basekick-labs/arc
<0.0.0-20260615160325-38402ad2ebdd GO-2026-6322
<0.0.0-20260615160325-38402ad2ebdd GO-2026-6322
Medium Risk
2 months ago
arc has unauthenticated cluster node admission when `cluster.shared_secret` is unset
<0.0.0-20260615160325-38402ad2ebdd GHSA-p378-jp5r-gpgw
<0.0.0-20260615160325-38402ad2ebdd GHSA-p378-jp5r-gpgw
Impacted packages
Timeline
Published
9 hours ago
November 05, 2026 at 10:55 PM UTC
Fixed (v0.0.0-20260610131716-5dc8f53b70a3)
4 months ago
June 10, 2026 at 01:17 PM UTC
Last Modified
8 hours ago
November 05, 2026 at 11:15 PM UTC