EUVD-2026-114443

Arc: DuckDB I/O aliases bypass database RBAC after CVE-2026-47735...

CVE-2026-55098

Arc is an open, SQL-native time-series database for telemetry. Prior to the repository-verified 26.06.2 repair, the remediation of CVE-2026-47735 leaves a cross-database authorization bypass through DuckDB table-valued I/O functions. In internal/database/sandbox.go, alloweddirectories uses...

CVE-2026-55098

The Arc time-series database contains a cross-database authorization bypass in versions prior to 26.06.2 . The vulnerability stems from an incomplete denylist in userSQLReadParquetPattern that fails to block specific DuckDB table-valued I/O functions such as parquet_scan, glob, parquet_metadata, ...

CVE-2026-55098

Arc is an open, SQL-native time-series database for telemetry. Prior to the repository-verified 26.06.2 repair, the remediation of "CVE-2026-47735" leaves a cross-database authorization bypass through DuckDB table-valued I/O functions. In "internal/database/sandbox.go", "alloweddirectories" uses...

CVE-2026-55098 Arc: DuckDB I/O aliases bypass database RBAC after CVE-2026-47735

Arc is an open, SQL-native time-series database for telemetry. Prior to the repository-verified 26.06.2 repair, the remediation of CVE-2026-47735 leaves a cross-database authorization bypass through DuckDB table-valued I/O functions. In internal/database/sandbox.go, alloweddirectories uses...

CVE-2026-55098 Arc: DuckDB I/O aliases bypass database RBAC after CVE-2026-47735

Arc is an open, SQL-native time-series database for telemetry. Prior to the repository-verified 26.06.2 repair, the remediation of CVE-2026-47735 leaves a cross-database authorization bypass through DuckDB table-valued I/O functions. In internal/database/sandbox.go, alloweddirectories uses...

CVE-2026-55098 Arc: DuckDB I/O aliases bypass database RBAC after CVE-2026-47735

Arc is an open, SQL-native time-series database for telemetry. Prior to the repository-verified 26.06.2 repair, the remediation of CVE-2026-47735 leaves a cross-database authorization bypass through DuckDB table-valued I/O functions. In internal/database/sandbox.go, alloweddirectories uses...

EUVD-2026-113930

ArcadeDB from 21.12.1 before 26.10.2 contains an authorization bypass vulnerability that allows users with only readRecord to replace the shared GraphQL schema via the read-only query endpoint. Attackers can send a GraphQL type definition with a crafted @sql directive to /api/v1/query/database,...

CVE-2026-55098: Basekick-Labs arc: Arc is an open, SQL-native time-series database for telemetry

Arc is an open, SQL-native time-series database for telemetry. Prior to the repository-verified 26.06.2 repair, the remediation of CVE-2026-47735 leaves a cross-database authorization bypass through DuckDB table-valued I/O functions. In internal/database/sandbox.go, alloweddirectories uses...

PT-2026-134187

Name of the Vulnerable Software and Affected Versions Arc versions prior to 26.06.2 Description An authorization bypass exists that allows cross-database access through DuckDB table-valued I/O functions. In internal/api/query.go, the extractTableReferences function skips names followed by an...

Trigger.dev: Cross-tenant SQL Injection In The TSQL Query Compiler (POST /api/v1/query) Via Unsanitized Window-function

Summary A cross-tenant SQL injection in the TSQL query compiler lets any authenticated trigger.dev customer read every other tenant's analytics data. The customer-facing query endpoint "POST /api/v1/query" accepts a TSQL/TRQL query that is compiled to ClickHouse SQL by "internal-packages/tsql". T...

CVE-2026-114081

Trigger.dev before 4.5.6 contains an SQL injection vulnerability in the TSQL query compiler, which concatenates window-function names into generated ClickHouse SQL without allowlisting or escaping. Authenticated customers can submit a backtick-quoted identifier to POST /api/v1/query that injects ...

CVE-2026-114065

Trigger.dev before 4.7.3 contains a tenant filtering bypass vulnerability that allows authenticated users to read other tenants' data by using placeholder table syntax in POST /api/v1/query. Attackers can submit queries with FROM database.table expressions, including within subqueries, to skip...

CVE-2026-114081

Trigger.dev before 4.5.6 contains an SQL injection vulnerability in the TSQL query compiler, which concatenates window-function names into generated ClickHouse SQL without allowlisting or escaping. Authenticated customers can submit a backtick-quoted identifier to POST /api/v1/query that injects ...

CVE-2026-114081 Trigger.dev before 4.5.6 Cross-Tenant SQL Injection via TSQL Window-Function Name

Trigger.dev before 4.5.6 contains an SQL injection vulnerability in the TSQL query compiler, which concatenates window-function names into generated ClickHouse SQL without allowlisting or escaping. Authenticated customers can submit a backtick-quoted identifier to POST /api/v1/query that injects ...

CVE-2026-114081

The software Trigger.dev before version 4.5.6 is vulnerable to a cross-tenant SQL injection in its TSQL query compiler. The root cause is the improper concatenation of window-function names into generated ClickHouse SQL without adequate escaping or allowlisting. Authenticated customers can exploi...

CVE-2026-114081 Trigger.dev before 4.5.6 Cross-Tenant SQL Injection via TSQL Window-Function Name

Trigger.dev before 4.5.6 contains an SQL injection vulnerability in the TSQL query compiler, which concatenates window-function names into generated ClickHouse SQL without allowlisting or escaping. Authenticated customers can submit a backtick-quoted identifier to POST /api/v1/query that injects ...

EUVD-2026-106884

Trigger.dev before 4.5.6 contains an SQL injection vulnerability in the TSQL query compiler, which concatenates window-function names into generated ClickHouse SQL without allowlisting or escaping. Authenticated customers can submit a backtick-quoted identifier to POST /api/v1/query that injects ...

CVE-2026-114081 Trigger.dev before 4.5.6 Cross-Tenant SQL Injection via TSQL Window-Function Name

Trigger.dev before 4.5.6 contains an SQL injection vulnerability in the TSQL query compiler, which concatenates window-function names into generated ClickHouse SQL without allowlisting or escaping. Authenticated customers can submit a backtick-quoted identifier to POST /api/v1/query that injects ...

CVE-2026-114065

Trigger.dev before 4.7.3 contains a tenant filtering bypass vulnerability that allows authenticated users to read other tenants' data by using placeholder table syntax in POST /api/v1/query. Attackers can submit queries with FROM database.table expressions, including within subqueries, to skip...