CVE-2026-47735

Name of the Vulnerable Software and Affected Versions Arc versions prior to 26.06.1

Description Arc is an open, SQL-native time-series database for telemetry. An authenticated user can perform an arbitrary local-file read by bypassing Role-Based Access Control (RBAC) table-level checks. The issue exists because the user-SQL validator in the ValidateSQLRequest() function within internal/api/query.go used a regex denylist that only blocked read parquet( and arc partition agg(, leaving other DuckDB I/O functions—such as read csv auto, read csv, read json, read json auto, read text, read blob, glob, parquet metadata, parquet schema, and read xlsx—unblocked. Additionally, RBAC table-reference extraction only inspected FROM and JOIN clauses, allowing scalar table functions in the SELECT list to bypass security layers.

This can be exploited via the /api/v1/query endpoint. Potential impacts include the exposure of sensitive files such as auth.db (containing bcrypt hashes), arc.toml (containing S3 secrets and TLS keys), and /proc/self/environ (containing environment-variable secrets). It also allows for cross-tenant Parquet file access and Server-Side Request Forgery (SSRF) when the httpfs extension is loaded, enabling access to instance metadata IPs.

Recommendations Update to version 26.06.1 or later. Restrict API access to known-trusted networks via firewall rules. As a temporary mitigation, add read csv*, read json*, and glob to the dangerousSQLPattern in internal/api/query.go.