Is CVE-2026-48050 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-48050 being exploited in the wild.

How severe is CVE-2026-48050?

High severity, with a CVSS score of 4, published 21 August 2026.

Which products and versions are affected?

Basekick Labs Arc < 0.0.0-20260520170331-32a4091fb949; github.com/basekick-labs/arc (Go) < 0.0.0-20260520170331-32a4091fb949, SEMVER:introduced=0,fixed=0.0.0-20260520170331-32a4091fb949.

Is there a fix for CVE-2026-48050?

Yes. github.com/basekick-labs/arc (Go): upgrade to 0.0.0-20260520170331-32a4091fb949 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-48050 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-48050?

Check whether you run Basekick Labs Arc or github.com/basekick-labs/arc (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-48050: Basekick-Labs Arc unauthenticated access to pprof debug endpoints

Q: Which products and versions are affected?

Basekick Labs Arc < 0.0.0-20260520170331-32a4091fb949; github.com/basekick-labs/arc (Go) < 0.0.0-20260520170331-32a4091fb949, SEMVER:introduced=0,fixed=0.0.0-20260520170331-32a4091fb949.

Q: Is there a fix for CVE-2026-48050?

Yes. github.com/basekick-labs/arc (Go): upgrade to 0.0.0-20260520170331-32a4091fb949 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-48050 attacked?

It is attacked over the network, in a hosted service.

Q: Am I affected by CVE-2026-48050?

Check whether you run Basekick Labs Arc or github.com/basekick-labs/arc (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-48050 · Severity: high · CVSS 4 · Published 2026-08-21

Arc, a Go-based application, contains a security flaw that allows anyone on the network to access internal debugging tools without a password. An attacker can use these tools to steal sensitive information from the server's memory, such as database queries and authentication data, or crash the service by forcing it to consume excessive processor power. This could lead to both data theft and significant service outages.

Technologies: Basekick Labs Arc, github.com/basekick-labs/arc (Go). Vendors: Basekick Labs, Go.

Quick answers

Is CVE-2026-48050 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-48050 being exploited in the wild.
How severe is CVE-2026-48050?: High severity, with a CVSS score of 4, published 21 August 2026.
Which products and versions are affected?: Basekick Labs Arc < 0.0.0-20260520170331-32a4091fb949; github.com/basekick-labs/arc (Go) < 0.0.0-20260520170331-32a4091fb949, SEMVER:introduced=0,fixed=0.0.0-20260520170331-32a4091fb949.
Is there a fix for CVE-2026-48050?: Yes. github.com/basekick-labs/arc (Go): upgrade to 0.0.0-20260520170331-32a4091fb949 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-48050 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-48050?: Check whether you run Basekick Labs Arc or github.com/basekick-labs/arc (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/basekick-labs/arc (Go): upgrade to 0.0.0-20260520170331-32a4091fb949 or later
```
go get github.com/basekick-labs/arc@v0.0.0-20260520170331-32a4091fb949
```

Technical details

Arc incorrectly registers Go's 'net/http/pprof' handlers at '/debug/pprof/*' and includes this path in 'PublicPrefixes', causing the authentication middleware to bypass token checks. A remote, unauthenticated attacker can access various pprof endpoints to leak in-memory state (including SQL strings and auth cache keys), call stacks, and execution traces. Furthermore, the '/debug/pprof/profile' endpoint can be abused to pin CPU cores for arbitrary durations, enabling a trivial denial-of-service (DoS) attack. The vulnerability is fixed in version v26.06.1 (commit 32a4091) by gating pprof behind environment variables and restricting it to a localhost listener.

Affected products

Basekick-Labs Arc < 0.0.0-20260520170331-32a4091fb949

Identifiers

CVE-2026-48050
GHSA-j93g-rp6m-j32m
GO-2026-5457

Timeline

2026-05-19: disclosed: Reported by Alex Manson
2026-05-31: advisory: Initial GitHub Advisory published
2026-06-11: patched: Advisory updated and reviewed with patch details

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.