Repository navigation
Security: Basekick-Labs/arc
Security
No security policy detected
This project has not set up a SECURITY.md file yet.
Report a vulnerability-
RBAC read and write restrictions were unreachable, and the database listing endpoints had no authorization at allGHSA-mcqm-h7hj-99fg published
Oct 5, 2026 by xe-nvdkHigh -
GET /api/v1/query/:measurement authorized only its path parameters, so a subquery in the `where` parameter read another tenant's measurementGHSA-qcf2-6hm7-62c5 published
Oct 5, 2026 by xe-nvdkHigh -
Replacement-scan guard covered only FROM and JOIN: a path literal after TABLE/SUMMARIZE/DESCRIBE/PIVOT/UNPIVOT reads any tenant's data with no permission checkGHSA-9rgq-j585-5fhq published
Oct 5, 2026 by xe-nvdkHigh -
RBAC bypass: three normalisation divergences let a query read measurements the permission check never sawGHSA-h3rq-5r29-2wrh published
Oct 5, 2026 by xe-nvdkHigh -
Authenticated query() SQL bypass in Arc estimate endpoint enables cross-tenant Parquet readsGHSA-w6w2-x8xv-q8x2 published
Oct 1, 2026 by xe-nvdkHigh -
JoinRequest HMAC Omits Security-Sensitive Fields, Enabling Cluster Topology TamperingGHSA-p2rx-8p53-cqh3 published
Oct 1, 2026 by xe-nvdkModerate -
Cached API tokens remain authorized after expirationGHSA-4v7m-m7xf-4h6v published
Oct 1, 2026 by xe-nvdkModerate -
Arc Enterprise Raft consensus transport lacks app-layer auth, enabling admin-token forgery and cluster compromiseGHSA-wwfh-qrfq-6f8g published
Sep 1, 2026 by xe-nvdkHigh -
Authenticated RBAC/tenant escape: query where-param bypasses DuckDB I/O-function denylist to read any databaseGHSA-wmjj-g8xc-6hwr published
Sep 1, 2026 by xe-nvdkModerate -
DuckDB bare-string replacement scan bypasses the I/O function-name denylist and the RBAC table extractorGHSA-w8x2-cccw-25f7 published
Sep 1, 2026 by xe-nvdkModerate
Learn more about advisories related to Basekick-Labs/arc in the GitHub Advisory Database