Executive brief
Arc, a Go-based application, contains a security flaw that allows anyone on the network to access internal debugging tools without a password. An attacker can use these tools to steal sensitive information from the server's memory, such as database queries and authentication data, or crash the service by forcing it to consume excessive processor power. This could lead to both data theft and significant service outages.
Technical details
Arc incorrectly registers Go's 'net/http/pprof' handlers at '/debug/pprof/*' and includes this path in 'PublicPrefixes', causing the authentication middleware to bypass token checks. A remote, unauthenticated attacker can access various pprof endpoints to leak in-memory state (including SQL strings and auth cache keys), call stacks, and execution traces. Furthermore, the '/debug/pprof/profile' endpoint can be abused to pin CPU cores for arbitrary durations, enabling a trivial denial-of-service (DoS) attack. The vulnerability is fixed in version v26.06.1 (commit 32a4091) by gating pprof behind environment variables and restricting it to a localhost listener.
Affected products
- Basekick-Labs Arc < 0.0.0-20260520170331-32a4091fb949
Timeline
- 2026-05-19: disclosed: Reported by Alex Manson
- 2026-05-31: advisory: Initial GitHub Advisory published
- 2026-06-11: patched: Advisory updated and reviewed with patch details