CVE-2026-48050

High

Description

Arc is an open, SQL-native time-series database for telemetry. Versions prior to 26.06.1 register Go's `net/http/pprof` handlers at `/debug/pprof/*` via `app.Use(pprof.New())` in `internal/api/server.go`, and `/debug/pprof` is added to `PublicPrefixes` in `cmd/arc/main.go`. The auth middleware short-circuits before the token check on prefix match, so the endpoints are reachable without any authentication. Version 26.06.1 contains a patch. Some workarounds are available. Block `/debug/pprof*` at a reverse proxy / load balancer in front of Arc, restrict Arc's API port to known-trusted networks via firewall rules, and/or patch the running build: comment out `app.Use(pprof.New())` in `internal/api/server.go` and rebuild.

SeverityHigh

CVSS8.8

Exploit probability—

ProductGithub.com/basekick-labs/arc

PublishedAug 21, 2026

First seenAug 21, 2026

Weakness typeCWE-200Sensitive information exposure CWE-306Missing authentication for critical function CWE-400Uncontrolled resource consumption

How to fix

Update

github.com/basekick-labs/arc0.0.0-20260520170331-32a4091fb949 or later

Affected products

Product	Affected versions	Fixed in
github.com/basekick-labs/arcGo	v < 0.0.0-20260520170331-32a4091fb949	0.0.0-20260520170331-32a4091fb949

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.