{"id":"EUVD-2026-64190","revision":"8bbcb139ad3747d2b984290bffcb88f3","records":[{"revision":"8bbcb139ad3747d2b984290bffcb88f3","observedAt":"2026-11-01T09:08:08.676+00:00","statement":{"source":"euvd","id":"EUVD-2026-64190","aliases":["CVE-2026-48050","GHSA-j93g-rp6m-j32m"],"title":"Arc is an open, SQL-native time-series database for telemetry. Versions prior to 26.06.1 register Go's `net/http/pprof` handlers at `/debug/pprof/*` via `app.Use(pprof.New())` in `internal/api/server.go`, and `/debug/pprof` is added to `Pub…","description":"Arc is an open, SQL-native time-series database for telemetry. Versions prior to 26.06.1 register Go's `net/http/pprof` handlers at `/debug/pprof/*` via `app.Use(pprof.New())` in `internal/api/server.go`, and `/debug/pprof` is added to `PublicPrefixes` in `cmd/arc/main.go`. The auth middleware short-circuits before the token check on prefix match, so the endpoints are reachable without any authentication. Version 26.06.1 contains a patch. Some workarounds are available. Block `/debug/pprof*` at a reverse proxy / load balancer in front of Arc, restrict Arc's API port to known-trusted networks via firewall rules, and/or patch the running build: comment out `app.Use(pprof.New())` in `internal/api/server.go` and rebuild.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N","score":8.8,"severity":null}],"references":["https://github.com/Basekick-Labs/arc/security/advisories/GHSA-j93g-rp6m-j32m","https://github.com/Basekick-Labs/arc/commit/32a4091fb949f9cf060cdd804a07f6450dc426a8","https://github.com/Basekick-Labs/arc/releases/tag/v26.06.1"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-64190","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Aug 21, 2026, 10:40:12 PM","dateUpdated":"Aug 25, 2026, 4:44:36 PM"},"relatedAdvisories":[{"id":"RHSA-2026:68006","title":"Red Hat Security Advisory: Red Hat Edge Manager Version 1.2.1 Security Update","vulnerabilityIds":["CVE-2026-6377","CVE-2026-13149","CVE-2026-13676","CVE-2026-17106","CVE-2026-27145","CVE-2026-33818","CVE-2026-41178","CVE-2026-44740","CVE-2026-45819","CVE-2026-48050","CVE-2026-50162","CVE-2026-56853","CVE-2026-56858","CVE-2026-56859","CVE-2026-56860","CVE-2026-56862","CVE-2026-59869","CVE-2026-69152","CVE-2026-71556","CVE-2026-73089","CVE-2026-73643","CVE-2026-75899","CVE-2026-75931","CVE-2026-75975","CVE-2026-76172","CVE-2026-81521","CVE-2026-84292","CVE-2026-84375","CVE-2026-84394"]},{"id":"RHSA-2026:68335","title":"Red Hat Security Advisory: Red Hat Edge Manager Version 1.2.1 Security Update","vulnerabilityIds":["CVE-2026-27145","CVE-2026-33818","CVE-2026-41178","CVE-2026-44740","CVE-2026-48050","CVE-2026-56852","CVE-2026-56853","CVE-2026-56858","CVE-2026-56859","CVE-2026-56860","CVE-2026-56862","CVE-2026-71556"]},{"id":"RHSA-2026:68334","title":"Red Hat Security Advisory: Red Hat Edge Manager Version 1.1.4 Security Update","vulnerabilityIds":["CVE-2026-25681","CVE-2026-27136","CVE-2026-27145","CVE-2026-33810","CVE-2026-33818","CVE-2026-39820","CVE-2026-39831","CVE-2026-41178","CVE-2026-42306","CVE-2026-42499","CVE-2026-42504","CVE-2026-44740","CVE-2026-46597","CVE-2026-48050","CVE-2026-56852","CVE-2026-56853","CVE-2026-56858","CVE-2026-56859","CVE-2026-56860","CVE-2026-56862","CVE-2026-69153","CVE-2026-71556","CVE-2026-81521"]},{"id":"RHSA-2026:68253","title":"Red Hat Security Advisory: Red Hat Edge Manager Version 1.1.4 Security Update","vulnerabilityIds":["CVE-2026-6377","CVE-2026-13149","CVE-2026-25681","CVE-2026-27136","CVE-2026-39820","CVE-2026-39831","CVE-2026-41178","CVE-2026-42306","CVE-2026-42499","CVE-2026-44740","CVE-2026-45819","CVE-2026-46597","CVE-2026-48050","CVE-2026-50162","CVE-2026-56858","CVE-2026-56859","CVE-2026-59869","CVE-2026-69152","CVE-2026-71556","CVE-2026-73088","CVE-2026-73089","CVE-2026-73643","CVE-2026-75899","CVE-2026-75931","CVE-2026-75975","CVE-2026-76172","CVE-2026-81521","CVE-2026-84292","CVE-2026-84375","CVE-2026-84394"]},{"id":"RHSA-2026:68044","title":"Red Hat Security Advisory: Red Hat Edge Manager Version 1.1.4 Security Update","vulnerabilityIds":["CVE-2026-6377","CVE-2026-13149","CVE-2026-25681","CVE-2026-27136","CVE-2026-27145","CVE-2026-33818","CVE-2026-39820","CVE-2026-39831","CVE-2026-41178","CVE-2026-42306","CVE-2026-42499","CVE-2026-42504","CVE-2026-44740","CVE-2026-45819","CVE-2026-46597","CVE-2026-48050","CVE-2026-50162","CVE-2026-56853","CVE-2026-56858","CVE-2026-56859","CVE-2026-56860","CVE-2026-56862","CVE-2026-59869","CVE-2026-69152","CVE-2026-71556","CVE-2026-73088","CVE-2026-73089","CVE-2026-73643","CVE-2026-75899","CVE-2026-75931","CVE-2026-75975","CVE-2026-76172","CVE-2026-81521","CVE-2026-84292","CVE-2026-84375","CVE-2026-84394"]},{"id":"RHSA-2026:68254","title":"Red Hat Security Advisory: Red Hat Edge Manager Version 1.2.1 Security Update","vulnerabilityIds":["CVE-2026-6377","CVE-2026-13149","CVE-2026-13676","CVE-2026-17106","CVE-2026-27145","CVE-2026-33818","CVE-2026-41178","CVE-2026-44740","CVE-2026-45819","CVE-2026-48050","CVE-2026-50162","CVE-2026-56853","CVE-2026-56858","CVE-2026-56859","CVE-2026-56860","CVE-2026-56862","CVE-2026-59869","CVE-2026-69152","CVE-2026-71556","CVE-2026-73089","CVE-2026-73643","CVE-2026-75899","CVE-2026-75931","CVE-2026-75975","CVE-2026-76172","CVE-2026-81521","CVE-2026-84292","CVE-2026-84375","CVE-2026-84394"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-64190","identifiers":["EUVD-2026-64190","CVE-2026-48050","GHSA-j93g-rp6m-j32m"]},"retained":false,"historicalAffected":[]}],"coverage":[]}