basekick-labs/arc Security Advisories | GitStock

medium2026-08-28

arc has unauthenticated cluster node admission when `cluster.shared_secret` is unset

GHSA-p378-jp5r-gpgw · CVE-2026-55678

high2026-06-11

Arc: Unauthenticated access to Go debug pprof endpoints leaks runtime state and enables CPU-burn DoS

GHSA-j93g-rp6m-j32m · CVE-2026-48050

high2026-06-08

Arc has an authenticated arbitrary local-file read via DuckDB I/O functions that bypasses RBAC table-level checks

GHSA-p2j4-c4g6-rpf5 · CVE-2026-47735