GO-2026-5523 Arc has an authenticated arbitrary local-file read via DuckDB I/O functions that bypasses RBAC table-level checks in github.com/basekick-labs/arc

Arc has an authenticated arbitrary local-file read via DuckDB I/O functions that bypasses RBAC table-level checks in github.com/basekick-labs/arc...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the DuckDB I/O functions, which bypass RBAC table-level checks. An attacker can access arbitrary local files and potentially sensitive information by submitting crafted SQL queries that invoke...

PT-2026-47624

Name of the Vulnerable Software and Affected Versions Arc versions prior to 26.06.1 Description Arc is an open, SQL-native time-series database for telemetry. An authenticated user can perform an arbitrary local-file read by bypassing Role-Based Access Control RBAC table-level checks. The issue...

PT-2026-47575

Summary Arc's user-SQL validator internal/api/query.go:ValidateSQLRequest blocked only read parquet and arc partition agg via regex denylist. The broader DuckDB I/O function family — read csv auto, read csv, read json, read json auto, read text, read blob, glob, parquet metadata, parquet schema,...