CVE-2026-48105
HighCVSS 8.3Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
Arc Enterprise prior to version 26.06.1 accepts attacker-chosen file paths in manifest-registration proposals in the Raft FSM without validating them against the configured storage backend. The only check is that the path is non-empty; there is no parent-traversal rejection, allowlist, scheme restriction, or length bound. Fixed in 2026.06.1.
Risk Assessment
An attacker could specify arbitrary file paths, potentially leading to reading or writing files outside the allowed area, compromising data integrity or system security.
Recommendation
Upgrade Arc to version 2026.06.1 or later. Restrict cluster network access, audit the cluster manifest for unexpected paths, and consider disabling cluster mode until the fix is applied.
Other vulnerabilities in Arc
See all- CVE-2026-48106High
Arc Enterprise prior to version 26.06.1 validates only the wire-format envelope (length, opcode) of inbound messages in the cluster replication receiver. The MsgReplicateSync payload is accepted without any application-layer authentication (no HMAC, signature, or per-message nonce). Transport-layer TLS/mTLS does not protect against application-layer tampering or replay. Fixed in 2026.06.1.
- CVE-2026-48050High
Arc versions prior to 26.06.1 register Go's net/http/pprof handlers at /debug/pprof/* and add /debug/pprof to PublicPrefixes, making these endpoints reachable without authentication. Version 26.06.1 contains a patch. Workarounds include blocking /debug/pprof* at a reverse proxy or restricting the API port to trusted networks.
- CVE-2026-47735High
Arc prior to version 26.06.1 blocked only read_parquet( and arc_partition_agg( via regex denylist in the user-SQL validator. Other DuckDB I/O functions (read_csv, read_json, glob, etc.) were not blocked. RBAC table-reference extraction only inspected FROM/JOIN clauses, so scalar table functions in SELECT slipped past. Fixed in 26.06.1 via a structural sandbox at the DuckDB layer.
- CVE-2026-33922Medium
A path traversal vulnerability was discovered in the Offline archives functionality of the local web interface due to insufficient validation of an input parameter. A local user with administrative credentials for the web interface could submit an archive name containing traversal sequences and delete arbitrary files reachable by the Arc process, which runs with administrative privileges on the host.
Original NVD description (English source)
Arc is an open, SQL-native time-series database for telemetry. Prior to version 26.06.1, Arc Enterprise's Raft FSM (`internal/cluster/raft/fsm.go:applyRegisterFile`) accepts attacker-chosen file paths in manifest-registration proposals without validating them against the configured storage backend. The only check is that the path is non-empty. There is no parent-traversal (`..`) rejection, no allowlist of legitimate prefixes, no scheme restriction (`s3://` vs local), and no length bound. This is fixed in 2026.06.1. Some workarounds are available. Restrict cluster network access to known-trusted peers via strict firewall rules, audit the cluster manifest for unexpected paths (any path not matching the configured storage backend root is suspect), and/or disable cluster mode until the fix is available.