The vulnerability in Basekick-Labs arc is an exposure of sensitive information (CWE-200) caused by the registration of Go's net/http/pprof handlers at /debug/pprof/* in versions before 26.06.1. The authentication middleware short-circuits on prefix match, allowing unauthenticated access to these profiling endpoints. This can leak internal profiling data which may aid attackers. The issue is fixed in version 26.06.1. Mitigations include blocking /debug/pprof* at a reverse proxy or load balancer, restricting API port access to trusted networks, or commenting out the pprof handler and rebuilding the application.

Unauthorized actors can access sensitive profiling endpoints without authentication, potentially exposing internal application performance and diagnostic data. This exposure can aid attackers in reconnaissance and further exploitation. The CVSS 4.0 score of 8.8 reflects high severity due to network attack vector, no required privileges or user interaction, and high impact on availability and confidentiality.

A patch is available in version 26.06.1. Users should upgrade to this version to remediate the vulnerability. If upgrading is not immediately possible, block access to /debug/pprof* endpoints at a reverse proxy or load balancer, restrict the API port to trusted networks using firewall rules, or comment out the pprof handler registration in internal/api/server.go and rebuild the application.