Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Informational severity, published 5 November 2026.

Which products and versions are affected?

Basekick Labs Arc all versions before v26.06.2; github.com/basekick-labs/arc (Go) SEMVER:introduced=0,fixed=0.0.0-20260615165136-bb7d9761ad98.

How is This vulnerability attacked?

It is attacked over the network, in a software library.

Check whether you run Basekick Labs Arc or github.com/basekick-labs/arc (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Arc unauthenticated application log disclosure via /api/v1/logs

Severity: info · Published 2026-11-05

Arc is a distributed operational platform that includes authentication controls to protect sensitive API endpoints. An attacker can retrieve recent application logs without authentication by accessing the /api/v1/logs endpoint, potentially exposing operational metadata such as internal paths, component names, and error details that could facilitate further attacks. The vulnerability bypasses the global authentication middleware due to route registration order, even when authentication is enabled by default.

Technologies: Basekick Labs Arc, github.com/basekick-labs/arc (Go). Vendors: Basekick Labs, Go.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Informational severity, published 5 November 2026.
Which products and versions are affected?: Basekick Labs Arc all versions before v26.06.2; github.com/basekick-labs/arc (Go) SEMVER:introduced=0,fixed=0.0.0-20260615165136-bb7d9761ad98.
Is there a fix for This vulnerability?: Yes. github.com/basekick-labs/arc (Go): upgrade to 0.0.0-20260615165136-bb7d9761ad98 or later. Until then: Until patched, restrict access to /api/v1/logs at a reverse proxy, firewall, ingress policy, or service mesh. If the endpoint is not needed, block it entirely. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a software library.
Am I affected?: Check whether you run Basekick Labs Arc or github.com/basekick-labs/arc (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/basekick-labs/arc (Go): upgrade to 0.0.0-20260615165136-bb7d9761ad98 or later
```
go get github.com/basekick-labs/arc@v0.0.0-20260615165136-bb7d9761ad98
```

Until patched, restrict access to /api/v1/logs at a reverse proxy, firewall, ingress policy, or service mesh. If the endpoint is not needed, block it entirely.

Technical details

The /api/v1/logs route is registered before the global Fiber authentication middleware is installed; Fiber's router matches routes in registration order and stops at the first match without calling the later middleware, allowing unauthenticated access. The logsHandler returns recent buffered application logs from a global 10,000-entry buffer without performing its own authorization checks. An unauthenticated network attacker can request up to 1,000 log entries from the last 1,440 minutes, disclosing operational metadata (component names, internal paths, request outcomes, error details).

Affected products

Basekick Labs Arc all versions before v26.06.2

Identifiers

GHSA-m3qr-fvp4-78xj
GO-2026-6907

Timeline

2026-06-25: disclosed
2026-06-25: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.