Skip to main content
cve.nowby Sazabi
← Go
GoPackage

github.com/basekick-labs/arc

6 known vulnerabilities (2 high, 2 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
6 · 2 high, 2 medium, 1 low
Registry
pkg.go.dev

Advisories 6

  • Arc has unauthenticated application log disclosure via `/api/v1/logs` in github.com/basekick-labs/arc

    Affected: fixed in 0.0.0-20260615165136-bb7d9761ad98.

  • Arc has unauthenticated application log disclosure via `/api/v1/logs`

    Affected: fixed in 0.0.0-20260615165136-bb7d9761ad98.

  • CVE-2026-55098Medium 6.5

    Arc: DuckDB I/O aliases bypass database RBAC after CVE-2026-47735

    Affected: fixed in 0.0.0-20260610131716-5dc8f53b70a3.

  • CVE-2026-55678Medium 6.9

    Arc: Unauthenticated cluster node admission when `cluster.shared_secret` is unset

    Affected: fixed in 0.0.0-20260615160325-38402ad2ebdd.

  • Arc has an authenticated arbitrary local-file read via DuckDB I/O functions that bypasses RBAC table-level checks

    Affected: fixed in 0.0.0-20260520141557-91bdc29d1a02.

  • Arc: Unauthenticated access to Go debug pprof endpoints leaks runtime state and enables CPU-burn DoS

    Affected: fixed in 0.0.0-20260520170331-32a4091fb949.