CVE-2026-48105

Arc is an open, SQL-native time-series database for telemetry. Prior to version 26.06.1, Arc Enterprise's Raft FSM internal/cluster/raft/fsm.go:applyRegisterFile accepts attacker-chosen file paths in manifest-registration proposals without validating them against the configured storage backend. T...

CVE-2026-48106

Arc Enterprise (an open, SQL-native time-series database for telemetry) prior to version 2026.06.1 has a vulnerability in its cluster replication receiver (internal/cluster/replication/receiver.go). The MsgReplicateSync payload is accepted without any application-layer authentication — no HMAC, s...

EUVD-2026-64193

Arc is an open, SQL-native time-series database for telemetry. Prior to version 26.06.1, Arc Enterprise's cluster replication receiver at internal/cluster/replication/receiver.go validates only the wire-format envelope length, opcode of inbound messages. The MsgReplicateSync payload itself is...

CVE-2026-48105 Arc Enterprise cluster FSM applyRegisterFile accepts arbitrary file paths without validation, enabling cluster-wide path-traversal worm primitive

Arc is an open, SQL-native time-series database for telemetry. Prior to version 26.06.1, Arc Enterprise's Raft FSM internal/cluster/raft/fsm.go:applyRegisterFile accepts attacker-chosen file paths in manifest-registration proposals without validating them against the configured storage backend. T...

CVE-2026-48105

Arc Enterprise (an open, SQL-native time-series database for telemetry) contains a path-traversal vulnerability in its Raft FSM (internal/cluster/raft/fsm.go:applyRegisterFile). Prior to version 26.06.1 , the function accepts attacker-chosen file paths in manifest-registration proposals with no v...

EUVD-2026-64192

Arc is an open, SQL-native time-series database for telemetry. Prior to version 26.06.1, Arc Enterprise's Raft FSM internal/cluster/raft/fsm.go:applyRegisterFile accepts attacker-chosen file paths in manifest-registration proposals without validating them against the configured storage backend. T...

CVE-2026-47735

Arc (Basekick Labs) is an open-source SQL-native time-series database for telemetry. Prior to 26.06.1 , its user-SQL validator (internal/api/query.go:ValidateSQLRequest) blocked only read_parquet( and arc_partition_agg( via regex denylist, while the broader DuckDB I/O function family (read_csv_au...

CVE-2026-48050 Arc: Unauthenticated access to Go debug pprof endpoints leaks runtime state and enables CPU-burn DoS

Arc is an open, SQL-native time-series database for telemetry. Versions prior to 26.06.1 register Go's net/http/pprof handlers at /debug/pprof/ via app.Usepprof.New in internal/api/server.go, and /debug/pprof is added to PublicPrefixes in cmd/arc/main.go. The auth middleware short-circuits before...

CVE-2026-48050

Arc (an open SQL-native time-series database for telemetry) versions prior to 26.06.1 expose Go's net/http/pprof debug endpoints at /debug/pprof/* without authentication. The root cause is that /debug/pprof is added to PublicPrefixes in cmd/arc/main.go, causing the auth middleware to short-circui...

EUVD-2026-63627

Incorrect authorization in Azure Arc allows an unauthorized attacker to elevate privileges over a network...

EUVD-2026-63621

Use of incorrectly-resolved name or reference in Azure Arc allows an unauthorized attacker to elevate privileges over a network...

PT-2026-79499

Name of the Vulnerable Software and Affected Versions Arc Enterprise versions prior to 26.06.1 Description The cluster replication receiver at internal/cluster/replication/receiver.go validates only the wire-format envelope of inbound messages. The MsgReplicateSync payload is accepted without...

PT-2026-79498

Name of the Vulnerable Software and Affected Versions Arc Enterprise versions prior to 26.06.1 Description Arc Enterprise's Raft FSM Finite State Machine in the applyRegisterFile function accepts attacker-chosen file paths in manifest-registration proposals without validating them against the...

CVE-2026-69555

Incorrect authorization in Azure Arc allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-65816

Use of incorrectly-resolved name or reference in Azure Arc allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-69555 Azure Arc Elevation of Privilege Vulnerability

...

CVE-2026-69555

Azure Arc is affected by an incorrect authorization flaw that allows an unauthenticated, remote attacker to elevate privileges over the network. The vulnerability is rated CVSS 3.1: 10.0 (CRITICAL) with a vector of AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N, indicating high confidentiality and integrity...

CVE-2026-69555 Azure Arc Elevation of Privilege Vulnerability

...

CVE-2026-65816 Azure Arc Elevation of Privilege Vulnerability

...

CVE-2026-65816

Azure Arc (Microsoft) is affected by an elevation of privilege vulnerability caused by the use of an incorrectly-resolved name or reference. An unauthorized, unauthenticated attacker can exploit this over the network to gain elevated privileges, with high impact on confidentiality, integrity, and...