CVE-2026-55098
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
A vulnerability in the Arc time-series database allows cross-database authorization bypass through DuckDB I/O functions such as parquet_scan, glob, read_csv_auto, and others not covered by the denylist. The previous fix for CVE-2026-47735 did not block these aliases and functions, enabling unauthorized access to other databases' data, schemas, and statistics within the allowed root directory.
Risk Assessment
The organization may experience unauthorized access to other tenants' telemetry data, schemas, and statistics, violating multi-tenant isolation and potentially leading to information leakage.
Recommendation
Immediately update Arc to version 26.06.2 or later, which includes the fix blocking dangerous DuckDB I/O functions. Additionally, verify that no unauthorized queries were executed prior to the update.
Other vulnerabilities in Arc
See all- CVE-2026-94181High
The Arc browser in affected versions contains an address bar spoofing issue. An attacker can use a <select> element that triggers requestFullscreen without displaying the fullscreen notification to spoof the browser address bar.
- CVE-2026-48106High
Arc Enterprise prior to version 26.06.1 validates only the wire-format envelope (length, opcode) of inbound messages in the cluster replication receiver. The MsgReplicateSync payload is accepted without any application-layer authentication (no HMAC, signature, or per-message nonce). Transport-layer TLS/mTLS does not protect against application-layer tampering or replay. Fixed in 2026.06.1.
- CVE-2026-48105High
Arc Enterprise prior to version 26.06.1 accepts attacker-chosen file paths in manifest-registration proposals in the Raft FSM without validating them against the configured storage backend. The only check is that the path is non-empty; there is no parent-traversal rejection, allowlist, scheme restriction, or length bound. Fixed in 2026.06.1.
- CVE-2026-48050High
Arc versions prior to 26.06.1 register Go's net/http/pprof handlers at /debug/pprof/* and add /debug/pprof to PublicPrefixes, making these endpoints reachable without authentication. Version 26.06.1 contains a patch. Workarounds include blocking /debug/pprof* at a reverse proxy or restricting the API port to trusted networks.
- CVE-2026-47735High
Arc prior to version 26.06.1 blocked only read_parquet( and arc_partition_agg( via regex denylist in the user-SQL validator. Other DuckDB I/O functions (read_csv, read_json, glob, etc.) were not blocked. RBAC table-reference extraction only inspected FROM/JOIN clauses, so scalar table functions in SELECT slipped past. Fixed in 26.06.1 via a structural sandbox at the DuckDB layer.
- CVE-2026-33922Medium
A path traversal vulnerability was discovered in the Offline archives functionality of the local web interface due to insufficient validation of an input parameter. A local user with administrative credentials for the web interface could submit an archive name containing traversal sequences and delete arbitrary files reachable by the Arc process, which runs with administrative privileges on the host.
Original NVD description (English source)
Arc is an open, SQL-native time-series database for telemetry. Prior to the repository-verified 26.06.2 repair, the remediation of `CVE-2026-47735` leaves a cross-database authorization bypass through DuckDB table-valued I/O functions. In `internal/database/sandbox.go`, `allowed_directories` uses `cfg.LocalStorageRoot`, configured by `storage.local_path`, while `enable_external_access=false` blocks access outside that entire multi-tenant root. `GetStoragePath` in `internal/storage/util.go` stores all databases beneath it. In `internal/api/query.go`, `extractTableReferences` skips names followed by an opening parenthesis and `checkQueryPermissions` allows queries with no extracted table references, including tokens with `permissions: []`. The `userSQLReadParquetPattern` denylist catches literal `read_parquet(` and the earlier protection also blocks `arc_partition_agg(`, but misses the `parquet_scan` alias and `glob`, `parquet_metadata`, `parquet_schema`, `read_blob`, `read_csv_auto`, `read_json` and `read_text`. A request to `POST /api/v1/query` using these unblocked functions passes `ValidateSQLRequest` and `convertSQLToStoragePaths` without tenant authorization, allowing reads and enumeration of other databases' time-series data, schema and per-column value-range statistics within the allowlisted root. The sandbox still blocks out-of-root OS files and HTTP SSRF, and the sibling SQLite token database outside the root is not exposed by this mechanism. The earlier 26.06.1 remediation does not comprehensively deny these I/O functions. Repository tag 26.06.2 contains the I/O-function repair and supplies the provisional remediation boundary; conflicting advisory affected-version statements require curator adjudication.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS