CVE-2026-48050

{"id": "CVE-2026-48050", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-48050", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-25T16:44:13.830681Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.8, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "Basekick-Labs", "product": "arc", "versions": [{"status": "affected", "version": "< 26.06.1"}]}]}], "published": "2026-08-21T23:16:25.070", "references": [{"url": "https://github.com/Basekick-Labs/arc/commit/32a4091fb949f9cf060cdd804a07f6450dc426a8", "source": "security-advisories@github.com"}, {"url": "https://github.com/Basekick-Labs/arc/releases/tag/v26.06.1", "source": "security-advisories@github.com"}, {"url": "https://github.com/Basekick-Labs/arc/security/advisories/GHSA-j93g-rp6m-j32m", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-200"}, {"lang": "en", "value": "CWE-306"}, {"lang": "en", "value": "CWE-400"}]}], "descriptions": [{"lang": "en", "value": "Arc is an open, SQL-native time-series database for telemetry. Versions prior to 26.06.1 register Go's `net/http/pprof` handlers at `/debug/pprof/*` via `app.Use(pprof.New())` in `internal/api/server.go`, and `/debug/pprof` is added to `PublicPrefixes` in `cmd/arc/main.go`. The auth middleware short-circuits before the token check on prefix match, so the endpoints are reachable without any authentication. Version 26.06.1 contains a patch. Some workarounds are available. Block `/debug/pprof*` at a reverse proxy / load balancer in front of Arc, restrict Arc's API port to known-trusted networks via firewall rules, and/or patch the running build: comment out `app.Use(pprof.New())` in `internal/api/server.go` and rebuild."}, {"lang": "es", "value": "Arc es una base de datos de series temporales abierta, nativa de SQL, para telemetr\u00eda. Las versiones anteriores a la 26.06.1 registran los manejadores 'net/http/pprof' de Go en '/debug/pprof/*' a trav\u00e9s de 'app.Use(pprof.New())' en 'internal/api/server.go', y '/debug/pprof' se a\u00f1ade a 'PublicPrefixes' en 'cmd/arc/main.go'. El middleware de autenticaci\u00f3n hace un cortocircuito antes de la verificaci\u00f3n del token en la coincidencia de prefijo, por lo que los puntos finales son accesibles sin ninguna autenticaci\u00f3n. La versi\u00f3n 26.06.1 contiene un parche. Algunas soluciones provisionales est\u00e1n disponibles. Bloquee '/debug/pprof' en un proxy inverso / balanceador de carga delante de Arc, restrinja el puerto API de Arc a redes conocidas y de confianza a trav\u00e9s de reglas de cortafuegos, y/o aplique un parche a la compilaci\u00f3n en ejecuci\u00f3n: comente 'app.Use(pprof.New())' en 'internal/api/server.go' y recompile."}], "lastModified": "2026-10-12T16:10:00.220", "sourceIdentifier": "security-advisories@github.com"}