Live › vulnerability › CVE-2026-55098
Arc is an SQL time-series database for telemetry; a crafted SQL request to its query endpoint can use DuckDB file-reading functions to bypass tenant checks. An attacker with a valid token can read other databases' time-series data, schemas and column value-range statistics within the shared storage root.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 20:25 UTC. All times on this page are UTC.
Teams running Arc with a shared multi-tenant storage root (storage.local_path) where tenants have query tokens. Single-tenant deployments or deployments where query tokens are tightly restricted are less exposed. The advisory notes the affected-version statements conflict, so verify against the fixed tag.
No product ranges from the sources yet.
26.06.2.storage.local_path in the Arc configuration; a shared multi-tenant root is the exposed setup.POST /api/v1/query endpoint is reachable from untrusted networks.26.06.2 or later, per the repository tag named in the description.26.06.2 are affected; the sources conflict on exact affected ranges.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Arc is an open, SQL-native time-series database for telemetry. Prior to the repository-verified 26.06.2 repair, the remediation of CVE-2026-47735 leaves a cross-database authorization bypass through DuckDB table-valued I/O functions. In internal/database/sandbox.go, allowed_directories uses cfg.LocalStorageRoot, configured by storage.local_path, while enable_external_access=false blocks access outside that entire multi-tenant root. GetStoragePath in internal/storage/util.go stores all databases beneath it. In internal/api/query.go, extractTableReferences skips names followed by an opening parenthesis and checkQueryPermissions allows queries with no extracted table references, including tokens with permissions: []. The userSQLReadParquetPattern denylist catches literal read_parquet( and the earlier protection also blocks arc_partition_agg(, but misses the parquet_scan alias and glob, parquet_metadata, parquet_schema, read_blob, read_csv_auto, read_json and read_text. A request to POST /api/v1/query using these unblocked functions passes ValidateSQLRequest and convertSQLToStoragePaths without tenant authorization, allowing reads and enumeration of other databases' time-series data, schema and per-column value-range statistics within the allowlisted root. The sandbox still blocks out-of-root OS files and HTTP SSRF, and the sibling SQLite token database outside the root is not exposed by this mechanism. The earlier 26.06.1 remediation does not comprehensively deny these I/O functions. Repository tag 26.06.2 contains the I/O-function repair and supplies the provisional remediation boundary; conflicting advisory affected-version statements require curator adjudication.
This page as .md · .json · in your agent: get_signal("CVE-2026-55098")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.