CVE-2026-48050: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor in Basekick-Labs arc

Arc, an open SQL-native time-series database, versions prior to 26.06.1 expose sensitive profiling information via Go's net/http/pprof endpoints at /debug/pprof/* without authentication. This happens because the authentication middleware short-circuits before token validation on matching public prefixes, including /debug/pprof. The vulnerability is identified as CWE-200 (Exposure of Sensitive Information) and related weaknesses CWE-306 and CWE-400. Version 26.06.1 includes a patch that removes this exposure. Mitigations include blocking the /debug/pprof endpoints at the network edge, restricting access to trusted networks, or disabling the pprof handler in the source code.

Unauthorized actors can access sensitive profiling data through the exposed /debug/pprof endpoints without authentication. This information disclosure can aid attackers in understanding the internal state and performance characteristics of the database, potentially facilitating further attacks or reconnaissance. The vulnerability has a CVSS 4.0 score of 8.8 (high severity), indicating significant risk if exploited.

A patch is available in Arc version 26.06.1 that addresses this vulnerability. Users should upgrade to this version to remediate the issue. If immediate patching is not possible, workarounds include blocking access to /debug/pprof* endpoints at the reverse proxy or load balancer, restricting Arc's API port to trusted networks via firewall rules, or disabling the pprof handler by commenting out app.Use(pprof.New()) in internal/api/server.go and rebuilding the application.