Security: Basekick-Labs/arc
Security
No security policy detected
This project has not set up a SECURITY.md file yet.
Report a vulnerability-
Unauthenticated application log disclosure via `/api/v1/logs`GHSA-m3qr-fvp4-78xj published
Jun 25, 2026 by xe-nvdkLow -
Unauthenticated cluster node admission when `cluster.shared_secret` is unsetGHSA-p378-jp5r-gpgw published
Jun 25, 2026 by xe-nvdkModerate -
Incomplete fix of CVE-2026-47735: parquet_scan() (read_parquet alias) and the read_blob/glob/parquet_metadata I/O family bypass the SQL denylist and RBAC, letting any authenticated token (incl. permissions:[]) read every database's data within the allowlisted storage rootGHSA-93cm-2v4m-c56c published
Jun 25, 2026 by xe-nvdkModerate -
Arc Enterprise cluster FSM applyRegisterFile accepts arbitrary file paths without validation, enabling cluster-wide path-traversal worm primitiveGHSA-f85q-mvg8-qf37 published
May 31, 2026 by xe-nvdkCritical -
Arc Enterprise cluster replication accepts unauthenticated MsgReplicateSync messages, enabling cluster-wide data injection from any TLS-trusted peerGHSA-wfgr-8x84-22q7 published
May 31, 2026 by xe-nvdkHigh -
Unauthenticated access to Go debug pprof endpoints leaks runtime state and enables CPU-burn DoSGHSA-j93g-rp6m-j32m published
May 31, 2026 by xe-nvdkModerate -
Authenticated arbitrary local-file read via DuckDB I/O functions bypasses RBAC table-level checksGHSA-p2j4-c4g6-rpf5 published
May 31, 2026 by xe-nvdkHigh
Learn more about advisories related to Basekick-Labs/arc in the GitHub Advisory Database