{"schemaVersion":3,"id":"CVE-2026-47735","aliases":["GHSA-p2j4-c4g6-rpf5","GO-2026-5523"],"status":"published","duplicateOf":null,"title":null,"description":"Arc is an open, SQL-native time-series database for telemetry. Prior to version 26.06.1, Arc's user-SQL validator (`internal/api/query.go:ValidateSQLRequest`) blocked only `read_parquet(` and `arc_partition_agg(` via regex denylist. The broader DuckDB I/O function family — `read_csv_auto`, `read_csv`, `read_json`, `read_json_auto`, `read_text`, `read_blob`, `glob`, `parquet_metadata`, `parquet_schema`, `read_xlsx`, etc. — was not blocked. RBAC table-reference extraction inspected only `FROM`/`JOIN` clauses, so scalar table functions in the `SELECT` list slipped past both layers. This is fixed in 2026.06.1 via a structural sandbox at the DuckDB layer. After lockdown, DuckDB refuses to open any file outside the allowlist and refuses further `INSTALL`/`LOAD`. Already-loaded extensions remain callable. Some workarounds are available. Restrict API access to known-trusted networks via firewall rules or, as a temporary mitigation, add `read_csv*`/`read_json*`/`glob` etc. to `dangerousSQLPattern` in `internal/api/query.go`.","dates":{"published":"2026-08-21T22:42:55.886Z","modified":"2026-08-25T13:35:54.838Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":7.1,"severity":"high","version":"4.0","versionLabel":"v4.0","source":"CVE.org","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"4.0","versionLabel":"v4.0","source":"CVE.org","score":7.1,"severity":"high","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","exploitability":null,"impact":null,"computed":false},{"version":"4.0","versionLabel":"v4.0","source":"OSV · Go","score":7.1,"severity":"high","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","exploitability":null,"impact":null,"computed":true},{"version":"4.0","versionLabel":"v4.0","source":"NVD","score":7.1,"severity":"high","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00431,"percentile":0.36176,"severity":"low","asOf":"2026-10-21T00:00:00.000Z","change":{"pp":0.13699999999999996,"baselineDate":"2026-09-21T00:00:00.000Z","baselineScore":0.00294},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00294,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00294,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00294,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00294,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00294,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00294,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00294,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00294,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00294,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00294,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00431,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00431,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00431,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00431,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00431,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00431,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00431,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00431,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00431,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00431,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00431,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00431,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00431,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00431,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00431,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00431,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00431,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00431,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00431,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00431,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00431,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00431,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00431,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00431,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00431,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00431,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00431,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.00431,"percentile":0.36176}],"last30":[{"date":"2026-09-21T00:00:00.000Z","score":0.00294,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00294,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00294,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00431,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00431,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00431,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00431,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00431,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00431,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00431,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00431,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00431,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00431,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00431,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00431,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00431,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00431,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00431,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00431,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00431,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00431,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00431,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00431,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00431,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00431,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00431,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00431,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00431,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00431,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00431,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.00431,"percentile":0.36176}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","description":"The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.","type":"weakness","status":"Stable","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/22.html"},{"id":"CWE-200","name":"Exposure of Sensitive Information to an Unauthorized Actor","description":"The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.","type":"weakness","status":"Draft","abstraction":"Class","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/200.html"},{"id":"CWE-918","name":"Server-Side Request Forgery (SSRF)","description":"The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.","type":"weakness","status":"Incomplete","abstraction":"Base","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/918.html"}],"affected":[{"vendor":"basekick-labs","product":"arc","name":"arc","label":"arc","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 2026.06.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2026.06.1","eol":null,"hubHref":"/vendor/basekick-labs/arc"},{"vendor":"github.com/basekick-labs","product":"arc","name":"github.com/basekick-labs/arc","label":"arc","ecosystem":"Go","cpePart":null,"purl":"pkg:golang/github.com/basekick-labs/arc","purlType":"golang","versions":[{"text":"< 0.0.0-20260520141557-91bdc29d1a02","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.0.0-20260520141557-91bdc29d1a02","eol":null,"hubHref":null}],"affectedCount":2,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://github.com/Basekick-Labs/arc/security/advisories/GHSA-p2j4-c4g6-rpf5","label":"github.com/Basekick-Labs/arc/security/advisories/GHSA-p2j4-c4g6-rpf5","hostname":"github.com","tags":["X Refsource CONFIRM","WEB","Advisory"]},{"url":"https://github.com/Basekick-Labs/arc/pull/442","label":"github.com/Basekick-Labs/arc/pull/442","hostname":"github.com","tags":["X Refsource MISC","WEB"]},{"url":"https://github.com/Basekick-Labs/arc/commit/91bdc29d1a02178ccf8c66375eccf85203108dfb","label":"github.com/Basekick-Labs/arc/commit/91bdc29d1a02178ccf8c66375eccf85203108dfb","hostname":"github.com","tags":["X Refsource MISC","WEB"]},{"url":"https://github.com/Basekick-Labs/arc/releases/tag/v26.06.1","label":"github.com/Basekick-Labs/arc/releases/tag/v26.06.1","hostname":"github.com","tags":["X Refsource MISC"]},{"url":"https://github.com/Basekick-Labs/arc","label":"github.com/Basekick-Labs/arc","hostname":"github.com","tags":["PACKAGE"]}],"lineage":{"upstream":[],"downstream":["OPENSUSE-SU-2026:21483-1"],"duplicates":[],"related":["OPENSUSE-SU-2026:21483-1"]},"timeline":[{"kind":"published","date":"2026-08-21T22:42:55.886Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-08-25T13:35:54.838Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":28,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-22T06:10:33.875Z","stale":false,"partial":false}}