github.com/basekick-labs/arc · Arc has unauthenticated application log disclosure via `/api/v1/logs`
Affects github.com/basekick-labs/arcSource GCVE Database
Rated by Threat Radar
- Patch
- Available – fixed in 0.0.0-20260615165136-bb7d9761ad98
Data as of 3 Nov 2026, 17:04 UTC
What to do
Upgrade github.com/basekick-labs/arc to 0.0.0-20260615165136-bb7d9761ad98.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Gogithub.com/basekick-labs/arc | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
A patch is available in version 0.0.0-20260615165136-bb7d9761ad98 that fixes this issue by ensuring the /api/v1/logs route is registered after the global authentication middleware or by adding explicit admin authentication middleware to the route. Until patched, operators should restrict access to /api/v1/logs using reverse proxies, firewalls, ingress policies, or service mesh controls. If the logs endpoint is not required, it should be blocked entirely to prevent unauthorized access.
Description
Arc exposes an unauthenticated endpoint at GET /api/v1/logs that returns recent application logs without requiring authentication, despite authentication being enabled by default. This occurs because the route is registered before the global authentication middleware, causing the middleware to be bypassed. The logs can include operational metadata and potentially sensitive information, which could aid attackers. A fix is available that involves reordering route registration or adding explicit authentication checks.
References
- github.com/Basekick-Labs/arc/security/advisories/GHSA-m3qr-fvp4-78xj (opens in a new tab)
- github.com/Basekick-Labs/arc/pull/506 (opens in a new tab)
- github.com/Basekick-Labs/arc/commit/bb7d9761ad9801e93837762ff7d37460f1df19dd (opens in a new tab)
- github.com/Basekick-Labs/arc (opens in a new tab)
- github.com/Basekick-Labs/arc/releases/tag/v26.06.2 (opens in a new tab)