Is CVE-2026-55098 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-55098 being exploited in the wild.

How severe is CVE-2026-55098?

Medium severity, with a CVSS score of 6.5, published 30 October 2026.

Which products and versions are affected?

Arc contributors Arc before 26.06.2; github.com/basekick-labs/arc (Go) < 0.0.0-20260610131716-5dc8f53b70a3, SEMVER:introduced=0,fixed=0.0.0-20260610131716-5dc8f53b70a3.

How is CVE-2026-55098 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-55098?

Check whether you run Arc contributors Arc or github.com/basekick-labs/arc (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55098: Arc SQL-native time-series database authorization bypass in DuckDB I/O functions

Q: Is there a fix for CVE-2026-55098?

Yes. github.com/basekick-labs/arc (Go): upgrade to 0.0.0-20260610131716-5dc8f53b70a3 or later. Until then: Until upgrading to 26.06.2, restrict network access to the Arc API endpoint (`POST /api/v1/query`) to trusted clients only, and monitor query logs for use of DuckDB I/O functions like `parquet_scan`, `glob`, `read_blob`, `read_csv_auto`, `read_json`, and `read_text` as indicators of exploitation attempts. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-55098 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-55098?

Check whether you run Arc contributors Arc or github.com/basekick-labs/arc (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55098 · Severity: medium · CVSS 6.5 · Published 2026-10-30

Arc is an open-source time-series database for telemetry that uses SQL queries to access stored data across multiple tenants. A flaw in the authorization checks allows unauthenticated or unprivileged users to read and enumerate other tenants' time-series data, schema information, and column statistics by using alternative DuckDB I/O functions that bypass the security filter. This breaks the multi-tenant isolation that prevents customers from accessing each other's data.

Technologies: github.com/basekick-labs/arc (Go). Vendors: Go.

Quick answers

Is CVE-2026-55098 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-55098 being exploited in the wild.
How severe is CVE-2026-55098?: Medium severity, with a CVSS score of 6.5, published 30 October 2026.
Which products and versions are affected?: Arc contributors Arc before 26.06.2; github.com/basekick-labs/arc (Go) < 0.0.0-20260610131716-5dc8f53b70a3, SEMVER:introduced=0,fixed=0.0.0-20260610131716-5dc8f53b70a3.
Is there a fix for CVE-2026-55098?: Yes. github.com/basekick-labs/arc (Go): upgrade to 0.0.0-20260610131716-5dc8f53b70a3 or later. Until then: Until upgrading to 26.06.2, restrict network access to the Arc API endpoint (`POST /api/v1/query`) to trusted clients only, and monitor query logs for use of DuckDB I/O functions like `parquet_scan`, `glob`, `read_blob`, `read_csv_auto`, `read_json`, and `read_text` as indicators of exploitation attempts. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55098 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-55098?: Check whether you run Arc contributors Arc or github.com/basekick-labs/arc (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/basekick-labs/arc (Go): upgrade to 0.0.0-20260610131716-5dc8f53b70a3 or later
```
go get github.com/basekick-labs/arc@v0.0.0-20260610131716-5dc8f53b70a3
```

Until upgrading to 26.06.2, restrict network access to the Arc API endpoint (`POST /api/v1/query`) to trusted clients only, and monitor query logs for use of DuckDB I/O functions like `parquet_scan`, `glob`, `read_blob`, `read_csv_auto`, `read_json`, and `read_text` as indicators of exploitation attempts.

Technical details

The vulnerability exists in the query validation logic in `internal/api/query.go`, where `extractTableReferences` and `checkQueryPermissions` fail to block all DuckDB table-valued I/O functions that can read files. While the denylist catches `read_parquet` and `arc_partition_agg`, it misses aliases and variants including `parquet_scan`, `glob`, `parquet_metadata`, `parquet_schema`, `read_blob`, `read_csv_auto`, `read_json`, and `read_text`. Requests using these unblocked functions bypass tenant authorization checks and gain read access to other databases' files and statistics stored within the allowed storage root. The sandbox still prevents access outside the storage root and to the external SQLite token database.

Affected products

Arc contributors Arc before 26.06.2

Identifiers

CVE-2026-55098
GHSA-93cm-2v4m-c56c
GO-2026-6913

Timeline

2026-10-30: disclosed
2026-06-02: patched: Repository tag 26.06.2 contains the I/O-function authorization repair

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.