CVE-2026-48050: Arc Time-Series Database Auth Bypass Flaw

CVE-2026-48050 Overview

CVE-2026-48050 affects Arc, an open, SQL-native time-series database for telemetry developed by Basekick Labs. Versions prior to 26.06.1 register Go's net/http/pprof handlers at /debug/pprof/* through app.Use(pprof.New()) in internal/api/server.go. The path /debug/pprof is also added to PublicPrefixes in cmd/arc/main.go, causing the authentication middleware to short-circuit before token validation. As a result, unauthenticated network attackers can reach the profiling endpoints and extract runtime data or trigger resource-intensive operations. The issue maps to [CWE-200] Information Exposure.

Critical Impact
Remote unauthenticated attackers can fetch heap dumps, goroutine stacks, and pin CPU cores through /debug/pprof/profile, exposing sensitive runtime data and degrading availability.

Affected Products

Basekick Labs Arc versions prior to 26.06.1
Arc deployments exposing the API port to untrusted networks
Arc builds using the default Fiber middleware configuration

Discovery Timeline

2026-08-21 - CVE-2026-48050 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-48050

Vulnerability Analysis

Arc uses the Fiber web framework and mounts the github.com/gofiber/fiber/v2/middleware/pprof middleware unconditionally in internal/api/server.go. This exposes the standard Go profiling routes under /debug/pprof/*, including heap, goroutine, allocs, profile, and trace. The service also declares /debug/pprof inside the PublicPrefixes list in cmd/arc/main.go.

The authentication middleware iterates PublicPrefixes first and returns early on a match, bypassing the token check. Any network-reachable caller can retrieve heap and goroutine dumps that may contain query strings, tokens in memory, or schema information. Requests to /debug/pprof/profile block a CPU core for the sampling duration, providing a straightforward availability attack.

Root Cause

The root cause is an insecure default configuration. The pprof handlers were registered globally rather than gated behind a debug flag or a localhost-only listener. Adding /debug/pprof to PublicPrefixes explicitly instructed the authentication layer to skip credential checks for those routes.

Attack Vector

Exploitation requires only network access to the Arc API port. No credentials, user interaction, or elevated privileges are needed. An attacker sends HTTP GET requests to /debug/pprof/heap, /debug/pprof/goroutine?debug=2, or /debug/pprof/profile?seconds=60 and receives profiling data or induces sustained CPU load.

// Security patch in cmd/arc/main.go
// Initialize shutdown coordinator
shutdownCoordinator := shutdown.New(30*time.Second, logger.Get("shutdown"))

// Opt-in pprof on a localhost listener (no-op unless ARC_DEBUG_PPROF=1).
// Replaces the previous behaviour where pprof was unconditionally
// mounted on the public Fiber app and any network-reachable caller
// could fetch heap dumps or pin a CPU core via /debug/pprof/profile.
// See cmd/arc/debug_pprof.go for the rationale. Closes audit #2
// (GHSA-j93g-rp6m-j32m) from 2026-05-19.
startDebugPprofIfEnabled(shutdownCoordinator, logger.Get("debug-pprof"))

Source: GitHub Commit 32a4091

The patch removes the Fiber pprof middleware import from internal/api/server.go and starts pprof on a localhost-only listener that is disabled unless ARC_DEBUG_PPROF=1.

Detection Methods for CVE-2026-48050

Indicators of Compromise

HTTP requests to /debug/pprof, /debug/pprof/heap, /debug/pprof/goroutine, /debug/pprof/profile, or /debug/pprof/trace from external or non-administrative sources
Anomalous CPU utilization spikes lasting 30 to 60 seconds on Arc processes, consistent with profile sampling
HTTP 200 responses to /debug/pprof/* endpoints in Arc access logs prior to patching

Detection Strategies

Query reverse proxy or load balancer logs for any successful requests matching the /debug/pprof* path pattern
Alert on outbound response payloads from Arc containing profile.pb.gz or Go pprof binary signatures
Correlate unauthenticated requests to Arc's API port with subsequent CPU or memory anomalies on the host

Monitoring Recommendations

Enable HTTP access logging on Arc and forward events to a centralized log platform for prefix-based alerting
Monitor process-level CPU metrics on Arc hosts and flag sustained single-core saturation
Track network connections to the Arc API port from sources outside the documented allowlist

How to Mitigate CVE-2026-48050

Immediate Actions Required

Upgrade Arc to version 26.06.1 or later, which removes the public pprof mount and gates profiling behind ARC_DEBUG_PPROF=1 on a localhost listener
Block /debug/pprof* at any reverse proxy or load balancer positioned in front of Arc
Restrict Arc's API port to known-trusted networks using host or network firewall rules
Audit access logs for prior unauthenticated requests to /debug/pprof/* endpoints

Patch Information

Basekick Labs released the fix in Arc 26.06.1. Review the GitHub Security Advisory GHSA-j93g-rp6m-j32m, the GitHub Release v26.06.1, and the remediation commit 32a4091.

Workarounds

Comment out app.Use(pprof.New()) in internal/api/server.go and rebuild the running binary
Deny /debug/pprof* at the reverse proxy layer with an explicit rule that returns HTTP 404 or 403
Bind Arc's API listener to an internal interface and require VPN or bastion access for all clients

bash

# Example nginx rule to block pprof paths in front of Arc
location ~ ^/debug/pprof {
    return 404;
}