Basekick-Labs vulnerabilities
We track 4 vulnerabilities in Basekick-Labs products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on August 21, 2026.
Latest Basekick-Labs vulnerabilities
- 8.3 High severity
arc: Missing Authentication for Critical Functionality
Arc is an open, SQL-native time-series database for telemetry. Prior to version 26.06.1, Arc Enterprise's cluster replication receiver at `internal/cluster/replication/receiver.go` validates only the wire-format envelope (length, opcode) of inbound messages. T
- 8.3 High severity
arc: Improper Limitation of a Pathname to a Restricted Directory
Arc is an open, SQL-native time-series database for telemetry. Prior to version 26.06.1, Arc Enterprise's Raft FSM (`internal/cluster/raft/fsm.go:applyRegisterFile`) accepts attacker-chosen file paths in manifest-registration proposals without validating them
- 8.8 High severity
arc: Exposure of Sensitive Information to an Unauthorized Actor
Arc is an open, SQL-native time-series database for telemetry. Versions prior to 26.06.1 register Go's `net/http/pprof` handlers at `/debug/pprof/*` via `app.Use(pprof.New())` in `internal/api/server.go`, and `/debug/pprof` is added to `PublicPrefixes` in `cmd
- 7.1 High severity
arc: Improper Limitation of a Pathname to a Restricted Directory
Arc is an open, SQL-native time-series database for telemetry. Prior to version 26.06.1, Arc's user-SQL validator (`internal/api/query.go:ValidateSQLRequest`) blocked only `read_parquet(` and `arc_partition_agg(` via regex denylist. The broader DuckDB I/O func