CVE-2026-55098

Name of the Vulnerable Software and Affected Versions Arc versions prior to 26.06.2

Description An authorization bypass exists that allows cross-database access through DuckDB table-valued I/O functions. In internal/api/query.go, the extractTableReferences function skips names followed by an opening parenthesis, and checkQueryPermissions allows queries with no extracted table references. While certain patterns are blocked, the system fails to restrict the parquet scan alias and functions such as glob(), parquet metadata(), parquet schema(), read blob(), read csv auto(), read json(), and read text(). A request to the POST /api/v1/query endpoint using these functions can bypass tenant authorization, enabling the reading and enumeration of other databases' time-series data, schemas, and per-column value-range statistics within the allowlisted root. The issue is rooted in how allowed directories in internal/database/sandbox.go and GetStoragePath in internal/storage/util.go handle the multi-tenant root.

Recommendations Update Arc to version 26.06.2.