# Arc unauthenticated application log disclosure via /api/v1/logs

Source: https://junglewise.ai/threats/arc-has-unauthenticated-application-log-disclosure-via-api-v1-logs-a055c7d7  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-03. Updated: 2026-11-05  
License: CC BY 4.0 with a link back

Severity: low · Published 2026-11-03

Arc is an application server framework that exposes application logs through an API endpoint that is accessible without authentication, even when authentication is enabled by default. An attacker on the network can retrieve up to 1,000 recent log entries containing operational metadata such as component names, internal paths, and database identifiers, which could assist in planning further attacks or expose sensitive information if secrets are logged.

Technologies: [Basekick Labs Arc](https://junglewise.ai/threats/technologies/arc), [github.com/basekick-labs/arc (Go)](https://junglewise.ai/threats/technologies/github-com-basekick-labs-arc). Vendors: [Basekick Labs](https://junglewise.ai/threats/vendors/basekick-labs), [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Low severity, published 3 November 2026.

**Which products and versions are affected?** Basekick Labs Arc before v26.06.2; github.com/basekick-labs/arc (Go) < 0.0.0-20260615165136-bb7d9761ad98, SEMVER:introduced=0,fixed=0.0.0-20260615165136-bb7d9761ad98.

**Is there a fix for This vulnerability?** Yes. github.com/basekick-labs/arc (Go): upgrade to 0.0.0-20260615165136-bb7d9761ad98 or later. Until then: Until patched, operators can restrict access to /api/v1/logs at a reverse proxy, firewall, ingress policy, or service mesh, or block the endpoint entirely if not needed. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network, in a software library.

**Am I affected?** Check whether you run Basekick Labs Arc or github.com/basekick-labs/arc (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/basekick-labs/arc (Go): upgrade to 0.0.0-20260615165136-bb7d9761ad98 or later

  ```sh
  go get github.com/basekick-labs/arc@v0.0.0-20260615165136-bb7d9761ad98
  ```


Until patched, operators can restrict access to /api/v1/logs at a reverse proxy, firewall, ingress policy, or service mesh, or block the endpoint entirely if not needed.

## Technical details

The GET /api/v1/logs endpoint is registered before the global Fiber authentication middleware is applied, causing the route to bypass authentication checks. The logsHandler reads from a global log buffer holding up to 10,000 entries and returns JSON without performing authorization checks. An unauthenticated network attacker can request logs with parameters like limit=1000 and since_minutes=1440 to retrieve recent application logs containing timestamps, severity levels, component names, messages, and caller information.

## Affected products

- Basekick Labs Arc before v26.06.2

## Timeline

- 2026-11-03: disclosed

## References

- [https://github.com/Basekick-Labs/arc/security/advisories/GHSA-m3qr-fvp4-78xj](https://github.com/Basekick-Labs/arc/security/advisories/GHSA-m3qr-fvp4-78xj)
- [https://github.com/Basekick-Labs/arc/pull/506](https://github.com/Basekick-Labs/arc/pull/506)

## Related threats

- [Arc unauthenticated application log disclosure via /api/v1/logs](https://junglewise.ai/threats/go-2026-6907-arc-has-unauthenticated-application-log-disclosure-via-api-bf3cce98)
- [Arc SQL-native time-series database authorization bypass in DuckDB I/O functions](https://junglewise.ai/threats/cve-2026-55098-arc-is-an-open-sql-native-time-series-database-for-telemetry)
- [Arc Enterprise authentication bypass in cluster node admission](https://junglewise.ai/threats/cve-2026-55678-arc-enterprise-authentication-bypass-in-cluster-node-admission)
- [Basekick-Labs Arc unauthenticated access to pprof debug endpoints](https://junglewise.ai/threats/cve-2026-48050-basekick-labs-arc-unauthenticated-access-to-pprof-debug-endpoints)
- [Basekick Labs Arc local file read and SSRF via DuckDB functions](https://junglewise.ai/threats/cve-2026-47735-basekick-labs-arc-local-file-read-and-ssrf-via-duckdb-functions)