{"id":"CVE-2026-48050","sourceIdentifier":"security-advisories@github.com","published":"2026-08-21T23:16:25.070","lastModified":"2026-10-12T16:10:00.220","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Arc is an open, SQL-native time-series database for telemetry. Versions prior to 26.06.1 register Go's `net/http/pprof` handlers at `/debug/pprof/*` via `app.Use(pprof.New())` in `internal/api/server.go`, and `/debug/pprof` is added to `PublicPrefixes` in `cmd/arc/main.go`. The auth middleware short-circuits before the token check on prefix match, so the endpoints are reachable without any authentication. Version 26.06.1 contains a patch. Some workarounds are available. Block `/debug/pprof*` at a reverse proxy / load balancer in front of Arc, restrict Arc's API port to known-trusted networks via firewall rules, and/or patch the running build: comment out `app.Use(pprof.New())` in `internal/api/server.go` and rebuild."},{"lang":"es","value":"Arc es una base de datos de series temporales abierta, nativa de SQL, para telemetría. Las versiones anteriores a la 26.06.1 registran los manejadores 'net/http/pprof' de Go en '/debug/pprof/*' a través de 'app.Use(pprof.New())' en 'internal/api/server.go', y '/debug/pprof' se añade a 'PublicPrefixes' en 'cmd/arc/main.go'. El middleware de autenticación hace un cortocircuito antes de la verificación del token en la coincidencia de prefijo, por lo que los puntos finales son accesibles sin ninguna autenticación. La versión 26.06.1 contiene un parche. Algunas soluciones provisionales están disponibles. Bloquee '/debug/pprof' en un proxy inverso / balanceador de carga delante de Arc, restrinja el puerto API de Arc a redes conocidas y de confianza a través de reglas de cortafuegos, y/o aplique un parche a la compilación en ejecución: comente 'app.Use(pprof.New())' en 'internal/api/server.go' y recompile."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"Basekick-Labs","product":"arc","versions":[{"version":"< 26.06.1","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-25T16:44:13.830681Z","id":"CVE-2026-48050","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-200"},{"lang":"en","value":"CWE-306"},{"lang":"en","value":"CWE-400"}]}],"references":[{"url":"https://github.com/Basekick-Labs/arc/commit/32a4091fb949f9cf060cdd804a07f6450dc426a8","source":"security-advisories@github.com"},{"url":"https://github.com/Basekick-Labs/arc/releases/tag/v26.06.1","source":"security-advisories@github.com"},{"url":"https://github.com/Basekick-Labs/arc/security/advisories/GHSA-j93g-rp6m-j32m","source":"security-advisories@github.com"}]}