Basekick-Labs arc vulnerabilities
6 published CVEs name Basekick-Labs arc among the affected products.
- 6Published CVEs6 of them scored
- 6Last 12 monthspublished in the last year
- 0Critical4 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-55098
Arc: DuckDB I/O aliases bypass database RBAC after CVE-2026-47735
Basekick-Labs · arc
Medium6.5 - CVE-2026-55678
Arc: Unauthenticated cluster node admission when `cluster.shared_secret` is unset
Basekick-Labs · arc
Medium6.9 - CVE-2026-48106
Arc Enterprise cluster replication accepts unauthenticated MsgReplicateSync messages, enabling cluster-wide data injection from any TLS-trusted peer
Basekick-Labs · arc
High8.3 - CVE-2026-48105
Arc Enterprise cluster FSM applyRegisterFile accepts arbitrary file paths without validation, enabling cluster-wide path-traversal worm primitive
Basekick-Labs · arc
High8.3 - CVE-2026-47735
Arc has an authenticated arbitrary local-file read via DuckDB I/O functions that bypasses RBAC table-level checks
Basekick-Labs · arc
High7.1 - CVE-2026-48050
Arc: Unauthenticated access to Go debug pprof endpoints leaks runtime state and enables CPU-burn DoS
Basekick-Labs · arc
High8.8