Arc CVE-2026-48050
HIGH
GHSA-j93g-rp6m-j32m
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable endpoint with no authentication gives AV:N/PR:N; unbounded CPU-burn DoS with no rate limiting yields A:H; runtime memory leaks (not plaintext credential exfiltration) justify C:L over C:H; no integrity impact applies.
Primary rating from Vendor (https://github.com/Basekick-Labs/arc).
CVSS VectorVendor: https://github.com/Basekick-Labs/arc
Lifecycle Timeline
5DescriptionCVE.org
Summary
Arc registers Go's net/http/pprof handlers at /debug/pprof/* via app.Use(pprof.New()) in internal/api/server.go, and /debug/pprof is added to PublicPrefixes in cmd/arc/main.go. The auth middleware short-circuits before the token check on prefix match, so the endpoints are reachable without any authentication.
Impact
Any network-reachable caller (no token required) can:
- Fetch
/debug/pprof/heap- leaks in-memory state: live SQL strings, decoded msgpack records, decompressed request bodies, cached*TokenInfo(the auth cache keys on SHA-256 of the plaintext token atauth.go:543). - Fetch
/debug/pprof/goroutine?debug=2- leaks call stacks, identifying internal code paths. - Fetch
/debug/pprof/profile?seconds=N- pins a CPU core for arbitrary duration. Trivial DoS amplification (one short HTTP request → minutes of server CPU). - Fetch
/debug/pprof/trace- long-duration execution trace, similar DoS profile.
No authentication, no rate limiting, no resource bound on the seconds parameter.
Patches
https://github.com/Basekick-Labs/arc/releases/tag/v26.06.1
Planned mitigation:
- Gate pprof registration behind an env var (
ARC_DEBUG_PPROF=1) that defaults to off. - When enabled, bind pprof to a separate localhost-only listener (
127.0.0.1:6060via dedicatednet/httpserver) so it's never reachable from the public API port. - Remove
/debug/pproffromPublicPrefixes. - Fix the
HasPrefixbug where"/debug/pprofX"matches"/debug/pprof".
Workarounds
- Block
/debug/pprof*at a reverse proxy / load balancer in front of Arc. - Restrict Arc's API port to known-trusted networks via firewall rules.
- Patch the running build: comment out
app.Use(pprof.New())ininternal/api/server.goand rebuild.
Credits
Reported by Alex Manson (@NeuroWinter, https://neurowinter.com/) on 2026-05-19.
AnalysisAI
Unauthenticated access to Go runtime profiling endpoints in Basekick-Labs Arc (all versions before v26.06.1) allows any network-reachable caller to extract sensitive in-memory state - including live SQL strings, decoded msgpack payloads, and SHA-256-keyed authentication token cache entries - and to trigger unbounded CPU consumption via the /debug/pprof/profile endpoint. The root cause is a two-part misconfiguration: pprof handlers are unconditionally registered on the public Fiber listener via app.Use(pprof.New()) in internal/api/server.go, and /debug/pprof is explicitly added to the auth middleware's PublicPrefixes list in cmd/arc/main.go, causing the token check to short-circuit before it runs. No public exploit has been identified and EPSS is low at 0.09%, but the attack requires no authentication and no special setup against any default Arc deployment reachable over the network.
Technical ContextAI
Arc is a Go-based API server built on the Fiber web framework. It integrates Go's standard library net/http/pprof package for runtime diagnostics. The vulnerability arises from two compounding decisions: first, app.Use(pprof.New()) registers all pprof HTTP handlers directly onto the public Fiber application instance in internal/api/server.go; second, cmd/arc/main.go adds the path prefix /debug/pprof to the auth middleware's PublicPrefixes allowlist. The middleware uses strings.HasPrefix to check whether an incoming request path starts with any listed prefix - a function that also has a secondary path-confusion bug, where /debug/pprofX matches /debug/pprof, meaning any path sharing those bytes bypasses authentication. The exposed pprof endpoints include /debug/pprof/heap (full heap memory dump), /debug/pprof/goroutine (all goroutine stacks), /debug/pprof/profile (CPU profiler, parameterized by seconds), and /debug/pprof/trace (execution tracer). CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) is the correct root-cause class, covering both the memory-state disclosure vector and the availability impact from the resource-unbounded profiling endpoints. The affected package is identified by CPE pkg:go/github.com/basekick-labs/arc, all versions before pseudo-version 0.0.0-20260520170331-32a4091fb949.
RemediationAI
The primary fix is to upgrade Basekick-Labs Arc to v26.06.1 or later, available at https://github.com/Basekick-Labs/arc/releases/tag/v26.06.1 (commit 32a4091fb949). This release removes pprof registration from the public Fiber listener entirely, making it opt-in via the environment variable ARC_DEBUG_PPROF=1 and binding exclusively to 127.0.0.1:6060 (overridable via ARC_DEBUG_PPROF_ADDR, with a mandatory second opt-in ARC_DEBUG_PPROF_ALLOW_NON_LOOPBACK=1 required before binding to a non-loopback address). If an immediate upgrade is not possible, three workarounds are available with distinct trade-offs: (1) Block all requests matching /debug/pprof* at a reverse proxy or load balancer before they reach Arc - this eliminates both the information disclosure and DoS vectors immediately, requires no application-side changes, and is fully reversible, making it the preferred interim control; (2) Restrict Arc's API port (default :8000) to known-trusted source networks via firewall rules - this reduces exposure but requires accurate network topology knowledge and does not protect against threats from within the trusted range; (3) Comment out app.Use(pprof.New()) in internal/api/server.go and rebuild the binary - this surgically removes the vulnerable handler registration but requires a source-code change and rebuild cycle, which may not be operationally feasible on short notice.
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today