github.com/basekick-labs/arc
Go · Package
Vulnerability alerts
Follow| Report | Product | Ecosystem | Severity | Fix status | Last updated |
|---|---|---|---|---|---|
| Arc: DuckDB I/O aliases bypass database RBAC after CVE-2026-47735 | github.com/basekick-labs/arc | Go | Medium | Fix reported | |
| Arc has unauthenticated application log disclosure via `/api/v1/logs` | github.com/basekick-labs/arc | Go | Low | Fix reported | |
| arc has unauthenticated cluster node admission when `cluster.shared_secret` is unset | github.com/basekick-labs/arc | Go | Medium | Fix reported | |
| Arc: Unauthenticated access to Go debug pprof endpoints leaks runtime state and enables CPU-burn DoS | github.com/basekick-labs/arc | Go | High | Fix reported | |
| Arc has an authenticated arbitrary local-file read via DuckDB I/O functions that bypasses RBAC table-level checks | github.com/basekick-labs/arc | Go | High | Fix reported |