Arc CVE-2026-55098

Requires an RBAC-enabled, multi-tenant Arc deployment running a version prior to 26.06.2 (the 26.06.1 partial fix is still vulnerable). The attacker must already hold a valid authenticated API token, but privilege can be minimal - even a token created with permissions:[] or scoped to a single database suffices, since RBAC never inspects table-valued function calls. Exploitation is performed by naming any of the unblocked DuckDB I/O functions (parquet_scan, glob, parquet_metadata, parquet_schema, read_blob, read_csv_auto, read_json, read_text) in a POST /api/v1/query request against any query endpoint (JSON, MsgPack, Arrow IPC, estimate). LIMITING FACTORS: single-database (non-multi-tenant) deployments are not cross-tenant affected; reads are confined to the allowlisted storage root, so out-of-root OS files, HTTP SSRF, and the sibling SQLite token database (./data/arc.db) are NOT reachable via this mechanism; and a valid token is mandatory (no unauthenticated access).

This is a medium-severity (CVSS 6.5) cross-database authorization bypass in Arc, scored AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - network-reachable, low-complexity, but requiring an authenticated low-privilege token, with high confidentiality impact and no integrity or availability impact. The signals are internally consistent: PR:L matches the GHSA finding that ANY authenticated token (including a least-privilege permissions:[] RBAC token) can exploit it, and C:H/I:N/A:N matches a pure read/enumeration primitive. The CISA KEV status is not indicated in the input (treat as not listed), and no EPSS score was provided, so widespread-exploitation probability cannot be quantified from the data. The vuln.today priority decision label is 'this_month' (not act_now/emergency), which aligns with a real-but-not-critical confidentiality issue gated behind authentication. The key nuance is exposure scope: GHSA explicitly states only RBAC-enabled MULTI-TENANT deployments are cross-tenant affected - single-database deployments are not - so real-world risk is conditional on deployment mode, and the credential requirement rules out anonymous mass exploitation. Net: a genuine priority for multi-tenant Arc operators to patch this month, not a drop-everything emergency, and lower-urgency for single-tenant users.

On an RBAC-enabled multi-tenant Arc deployment, an attacker holding any valid API token - even one created with permissions:[] and scoped only to their own database - sends a POST /api/v1/query request whose SQL names an unblocked DuckDB I/O function (e.g. SELECT * FROM parquet_scan('./data/arc/<victim-db>/<measurement>/**/*.parquet')). Because the query has no extracted table references, RBAC authorization is skipped and the path resolves inside the allowlisted storage root, returning another tenant's time-series rows, file listings, schema, and per-column value-range statistics. A working proof-of-concept and sample output are published in the vendor's GHSA advisory and repository (poc/poc_sandbox_alias_bypass.py, poc/OUTPUT.txt); exploitation is low-complexity once a token is held.