CVE-2026-48050

Received Received - Intake

Unauthenticated Access to Debug Endpoints in Arc Time-Series Database

Publication date: 2026-08-21

Last updated on: 2026-08-21

Assigner: GitHub, Inc.

Description

Arc is an open, SQL-native time-series database for telemetry. Versions prior to 26.06.1 register Go's `net/http/pprof` handlers at `/debug/pprof/*` via `app.Use(pprof.New())` in `internal/api/server.go`, and `/debug/pprof` is added to `PublicPrefixes` in `cmd/arc/main.go`. The auth middleware short-circuits before the token check on prefix match, so the endpoints are reachable without any authentication. Version 26.06.1 contains a patch. Some workarounds are available. Block `/debug/pprof*` at a reverse proxy / load balancer in front of Arc, restrict Arc's API port to known-trusted networks via firewall rules, and/or patch the running build: comment out `app.Use(pprof.New())` in `internal/api/server.go` and rebuild.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-21

Last Modified

2026-08-21

Generated

2026-08-22

AI Q&A

2026-08-22

EPSS Evaluated

N/A

NVD

CVE-2026-48050

Affected Vendors & Products

Vendor	Product	Version / Range
arc	arc	to 26.06.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

This vulnerability affects Arc, an open SQL-native time-series database. Versions before 26.06.1 expose Go's built-in pprof debugging endpoints at /debug/pprof/* without authentication. The auth middleware fails to enforce token checks on these endpoints, allowing unauthorized access to profiling data.

Detection Guidance

Check if Arc is running with exposed `/debug/pprof/*` endpoints by accessing http://<arc-server>:<port>/debug/pprof/. If accessible without authentication, the system is vulnerable. Use curl commands like 'curl -v http://localhost:port/debug/pprof/' to test. Ensure no firewall or proxy is blocking these paths.

Verify Arc version with 'arc version' or check running processes for unpatched builds. Compare installed version against 26.06.1 or later.

Impact Analysis

Unauthenticated access to /debug/pprof/* could expose sensitive runtime information, including stack traces, memory stats, and running processes. Attackers might use this data to identify weaknesses or craft further exploits against the Arc database.

Compliance Impact

This vulnerability allows unauthenticated access to debug endpoints, which could expose sensitive telemetry data. This may violate data protection requirements under GDPR (e.g., unauthorized access to personal data) and HIPAA (e.g., exposure of protected health information).

Mitigation Strategies

Block `/debug/pprof*` at reverse proxies or load balancers. Restrict Arc's API port access to trusted networks via firewall rules. Patch by commenting out 'app.Use(pprof.New())' in 'internal/api/server.go' and rebuilding Arc.

Hi! I’m here to help you understand CVE-2026-48050. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70