CVE-2026-47735: Arc Time-Series Database SQLi Vulnerability

CVE-2026-47735 Overview

CVE-2026-47735 is a path traversal vulnerability [CWE-22] in Arc, an open, SQL-native time-series database for telemetry. Versions prior to 26.06.1 shipped a weak SQL validator in internal/api/query.go:ValidateSQLRequest that only blocked read_parquet( and arc_partition_agg( through a regex denylist. Authenticated users could invoke other DuckDB I/O functions such as read_csv_auto, read_json, read_text, read_blob, glob, and parquet_metadata to read arbitrary files. The Role-Based Access Control (RBAC) layer only inspected FROM/JOIN clauses, letting scalar table functions in the SELECT list bypass table-level checks.

Critical Impact
Authenticated Arc users could read arbitrary files reachable by the Arc process and exfiltrate them through SQL query responses, bypassing RBAC.

Affected Products

Basekick Labs Arc time-series database prior to version 26.06.1
Deployments exposing the Arc query API to non-trusted networks
Arc instances relying on the dangerousSQLPattern denylist for isolation

Discovery Timeline

2026-08-21 - CVE-2026-47735 published to the National Vulnerability Database (NVD)
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-47735

Vulnerability Analysis

Arc embeds DuckDB as its query engine and exposes SQL execution through an HTTP API. The pre-patch validator relied on a small regex denylist to gate dangerous constructs. This approach failed to enumerate the full DuckDB I/O function family, which includes read_csv_auto, read_csv, read_json, read_json_auto, read_text, read_blob, glob, parquet_metadata, parquet_schema, and read_xlsx. Any of these functions accept a file path or URI and return contents accessible to the caller.

The RBAC layer compounded the exposure. Table-reference extraction inspected only FROM and JOIN clauses, so a scalar table function placed inside a SELECT list evaded permission checks entirely. A low-privileged authenticated user could construct a query that returned host filesystem contents without referencing any RBAC-protected table.

Root Cause

The root cause is denylist-based input validation for a SQL surface that supports many equivalent I/O primitives. Blocking specific function names cannot enumerate all DuckDB paths to filesystem or network reads, especially as new extensions become loadable at runtime.

Attack Vector

An authenticated network attacker submits a crafted SQL request to the Arc query endpoint. Because the vulnerability requires only low privileges over the network with no user interaction, exploitation is straightforward for any principal holding valid API credentials.

// Patch excerpt from internal/api/import.go
// The fix threads a sandbox-allowlisted uploadDir through the handler and
// warns when it is empty so misconfiguration surfaces at startup.
func NewImportHandler(db *database.DuckDB, storage storage.Backend, uploadDir string, logger zerolog.Logger) *ImportHandler {
    componentLogger := logger.With().Str("component", "import-handler").Logger()
    if uploadDir == "" {
        componentLogger.Warn().Msg("NewImportHandler called with empty uploadDir — imports will fail under the DuckDB sandbox; cmd/arc/main.go should pass the sandbox-allowlisted upload directory")
    }
}

Source: GitHub Commit 91bdc29

Detection Methods for CVE-2026-47735

Indicators of Compromise

Query logs containing DuckDB I/O functions such as read_csv_auto, read_json, read_text, read_blob, glob, parquet_metadata, or parquet_schema in user-submitted SQL.
SQL statements that place scalar table functions inside the SELECT list rather than the FROM clause.
API responses returning file paths or content that do not match any registered Arc dataset.

Detection Strategies

Parse Arc application logs for calls to DuckDB reader functions outside the expected ingest pipeline.
Alert on any INSTALL or LOAD extension attempt originating from user-submitted queries.
Correlate authenticated API sessions with abnormal query response sizes indicative of file exfiltration.

Monitoring Recommendations

Ship Arc query logs and DuckDB audit output to a central log platform for retention and query.
Baseline normal SQL patterns per API token and flag deviations that reference filesystem paths.
Monitor network egress from Arc hosts for unexpected outbound connections initiated by DuckDB.

How to Mitigate CVE-2026-47735

Immediate Actions Required

Upgrade Arc to version 26.06.1 or later, which applies a structural DuckDB sandbox with enable_external_access=false and an allowed_directories allowlist.
Restrict access to the Arc API using firewall rules so only known-trusted networks can reach the query endpoint.
Rotate any API tokens that may have been used to invoke unsanctioned DuckDB reader functions.

Patch Information

The fix ships in GitHub Release v26.06.1 and is described in GitHub Security Advisory GHSA-p2j4-c4g6-rpf5. The patch commit is documented in GitHub Commit 91bdc29 and GitHub Pull Request 442. After lockdown, DuckDB refuses to open files outside the allowlist and rejects further INSTALL and LOAD calls, though already-loaded extensions remain callable.

Workarounds

Restrict API access to trusted networks through firewall or reverse-proxy rules until the upgrade is deployed.
As a temporary mitigation, extend the dangerousSQLPattern denylist in internal/api/query.go to include read_csv*, read_json*, read_text, read_blob, glob, parquet_metadata, parquet_schema, and read_xlsx.
Audit issued API tokens and remove any that are not strictly required for ingest or query workloads.

bash

# Upgrade Arc to the patched release
git fetch --tags
git checkout v26.06.1
# Ensure cmd/arc/main.go passes the sandbox-allowlisted upload directory
# to NewImportHandler so post-lockdown imports continue to work.