# Arc unauthenticated application log disclosure via /api/v1/logs

Source: https://junglewise.ai/threats/go-2026-6907-arc-has-unauthenticated-application-log-disclosure-via-api-bf3cce98  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-05. Updated: 2026-11-07  
License: CC BY 4.0 with a link back

Severity: info · Published 2026-11-05

Arc is a distributed operational platform that includes authentication controls to protect sensitive API endpoints. An attacker can retrieve recent application logs without authentication by accessing the /api/v1/logs endpoint, potentially exposing operational metadata such as internal paths, component names, and error details that could facilitate further attacks. The vulnerability bypasses the global authentication middleware due to route registration order, even when authentication is enabled by default.

Technologies: [Basekick Labs Arc](https://junglewise.ai/threats/technologies/arc), [github.com/basekick-labs/arc (Go)](https://junglewise.ai/threats/technologies/github-com-basekick-labs-arc). Vendors: [Basekick Labs](https://junglewise.ai/threats/vendors/basekick-labs), [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Informational severity, published 5 November 2026.

**Which products and versions are affected?** Basekick Labs Arc all versions before v26.06.2; github.com/basekick-labs/arc (Go) SEMVER:introduced=0,fixed=0.0.0-20260615165136-bb7d9761ad98.

**Is there a fix for This vulnerability?** Yes. github.com/basekick-labs/arc (Go): upgrade to 0.0.0-20260615165136-bb7d9761ad98 or later. Until then: Until patched, restrict access to /api/v1/logs at a reverse proxy, firewall, ingress policy, or service mesh. If the endpoint is not needed, block it entirely. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network, in a software library.

**Am I affected?** Check whether you run Basekick Labs Arc or github.com/basekick-labs/arc (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/basekick-labs/arc (Go): upgrade to 0.0.0-20260615165136-bb7d9761ad98 or later

  ```sh
  go get github.com/basekick-labs/arc@v0.0.0-20260615165136-bb7d9761ad98
  ```


Until patched, restrict access to /api/v1/logs at a reverse proxy, firewall, ingress policy, or service mesh. If the endpoint is not needed, block it entirely.

## Technical details

The /api/v1/logs route is registered before the global Fiber authentication middleware is installed; Fiber's router matches routes in registration order and stops at the first match without calling the later middleware, allowing unauthenticated access. The logsHandler returns recent buffered application logs from a global 10,000-entry buffer without performing its own authorization checks. An unauthenticated network attacker can request up to 1,000 log entries from the last 1,440 minutes, disclosing operational metadata (component names, internal paths, request outcomes, error details).

## Affected products

- Basekick Labs Arc all versions before v26.06.2

## Identifiers

- GHSA-m3qr-fvp4-78xj
- GO-2026-6907

## Timeline

- 2026-06-25: disclosed
- 2026-06-25: patched

## References

- [https://github.com/Basekick-Labs/arc/security/advisories/GHSA-m3qr-fvp4-78xj](https://github.com/Basekick-Labs/arc/security/advisories/GHSA-m3qr-fvp4-78xj)
- [https://github.com/Basekick-Labs/arc/commit/bb7d9761ad9801e93837762ff7d37460f1df19dd](https://github.com/Basekick-Labs/arc/commit/bb7d9761ad9801e93837762ff7d37460f1df19dd)

## Related threats

- [Arc unauthenticated application log disclosure via /api/v1/logs](https://junglewise.ai/threats/arc-has-unauthenticated-application-log-disclosure-via-api-v1-logs-a055c7d7)
- [Arc SQL-native time-series database authorization bypass in DuckDB I/O functions](https://junglewise.ai/threats/cve-2026-55098-arc-is-an-open-sql-native-time-series-database-for-telemetry)
- [Arc Enterprise authentication bypass in cluster node admission](https://junglewise.ai/threats/cve-2026-55678-arc-enterprise-authentication-bypass-in-cluster-node-admission)
- [Basekick-Labs Arc unauthenticated access to pprof debug endpoints](https://junglewise.ai/threats/cve-2026-48050-basekick-labs-arc-unauthenticated-access-to-pprof-debug-endpoints)
- [Basekick Labs Arc local file read and SSRF via DuckDB functions](https://junglewise.ai/threats/cve-2026-47735-basekick-labs-arc-local-file-read-and-ssrf-via-duckdb-functions)