Arc, an open SQL-native time-series database, had insufficient validation of user-SQL queries before version 26.06.1. Its validator blocked only specific functions like read_parquet and arc_partition_agg via regex denylist, but many DuckDB I/O functions (e.g., read_csv_auto, read_json, glob) were not blocked. RBAC enforcement inspected only FROM/JOIN clauses, allowing scalar table functions in SELECT to bypass restrictions. This enabled potential path traversal attacks by accessing files outside restricted directories. The vulnerability is fixed in version 26.06.1 by adding a structural sandbox in DuckDB that enforces an allowlist for file access and disables further INSTALL/LOAD commands, though already loaded extensions remain usable. Temporary mitigations include restricting API access to trusted networks or expanding the denylist for dangerous SQL patterns.

The vulnerability allows an attacker with low privileges and no user interaction to bypass access controls and read files outside the intended restricted directories via unblocked DuckDB I/O functions in SQL queries. This can lead to unauthorized data disclosure. The CVSS 4.0 score is 7.1 (high severity), reflecting network attack vector, low complexity, no privileges required, no user interaction, and high confidentiality impact. There is no known exploitation in the wild reported.

A fix is available in Arc version 26.06.1, which implements a structural sandbox at the DuckDB layer to restrict file access to an allowlist and disables further extension installs or loads. Until upgrading, it is recommended to restrict API access to trusted networks using firewall rules. As a temporary workaround, administrators can add additional DuckDB I/O functions such as read_csv*, read_json*, and glob to the dangerousSQLPattern denylist in internal/api/query.go to block them at the SQL validator level.