What’s Vulnerable › Products

Basekick-Labs arc vulnerabilities

6 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 6 published in the last 12 months.

Check whether your Basekick-Labs arc version is affected

Latest Basekick-Labs arc vulnerabilities

• CVE-2026-55098 — Arc: DuckDB I/O aliases bypass database RBAC after CVE-2026-47735 (CVSS 6.5)
• CVE-2026-55678 — Arc: Unauthenticated cluster node admission when `cluster.shared_secret` is unset (CVSS 6.9)
• CVE-2026-48106 — Arc Enterprise cluster replication accepts unauthenticated MsgReplicateSync messages, enabling cluster-wide data injection from any TLS-trusted peer (CVSS 8.3)
• CVE-2026-48105 — Arc Enterprise cluster FSM applyRegisterFile accepts arbitrary file paths without validation, enabling cluster-wide path-traversal worm primitive (CVSS 8.3)
• CVE-2026-48050 — Arc: Unauthenticated access to Go debug pprof endpoints leaks runtime state and enables CPU-burn DoS (CVSS 8.8)
• CVE-2026-47735 — Arc has an authenticated arbitrary local-file read via DuckDB I/O functions that bypasses RBAC table-level checks (CVSS 7.1)