Detections
Analytics

SCA: security update for github.com/basekick-labs/arc (GHSA-93cm-2v4m-c56c)

medium Tenable Self-Hosted Container Security Plugin ID 478343

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Arc is an open, SQL-native time-series database for telemetry. Prior to the repository-verified 26.06.2
 repair, the remediation of `CVE-2026-47735` leaves a cross-database authorization bypass through DuckDB
 table-valued I/O functions. In `internal/database/sandbox.go`, `allowed_directories` uses
 `cfg.LocalStorageRoot`, configured by `storage.local_path`, while `enable_external_access=false` blocks
 access outside that entire multi-tenant root. `GetStoragePath` in `internal/storage/util.go` stores all
 databases beneath it. In `internal/api/query.go`, `extractTableReferences` skips names followed by an
 opening parenthesis and `checkQueryPermissions` allows queries with no extracted table references,
 including tokens with `permissions: []`. The `userSQLReadParquetPattern` denylist catches literal
 `read_parquet(` and the earlier protection also blocks `arc_partition_agg(`, but misses the `parquet_scan`
 alias and `glob`, `parquet_metadata`, `parquet_schema`, `read_blob`, `read_csv_auto`, `read_json` and
 `read_text`. A request to `POST /api/v1/query` using these unblocked functions passes `ValidateSQLRequest`
 and `convertSQLToStoragePaths` without tenant authorization, allowing reads and enumeration of other
 databases' time-series data, schema and per-column value-range statistics within the allowlisted root. The
 sandbox still blocks out-of-root OS files and HTTP SSRF, and the sibling SQLite token database outside the
 root is not exposed by this mechanism. The earlier 26.06.1 remediation does not comprehensively deny these
 I/O functions. Repository tag 26.06.2 contains the I/O-function repair and supplies the provisional
 remediation boundary; conflicting advisory affected-version statements require curator adjudication.
 (CVE-2026-55098)

Solution

Update the github.com/basekick-labs/arc library and its related packages to version 0.0.0-20260610131716-5dc8f53b70a3 or later.

See Also

https://github.com/advisories/GHSA-93cm-2v4m-c56c

Plugin Details

Severity: Medium

ID: 478343

Version: Revision 1.1

Type: Local

Family: SCA Checks

Published: 11/4/2026

Updated: 11/4/2026

Risk Information

VPR

Risk Factor: Medium

Score: 5.7

Percentile: 95.64

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:N/A:N

CVSS Score Source: CVE-2026-55098

CVSS v3

Risk Factor: Medium

Base Score: 6.5

Temporal Score: 5.7

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 11/4/2026

Vulnerability Publication Date: 10/30/2026

Reference Information

CVE: CVE-2026-55098