{"id":"CVE-2026-55098","kind":"vulnerability","aliases":["CVE-2026-55098"],"related":[],"title":"Arc time-series database: query endpoint lets tenants read other databases","description":"Arc is an open, SQL-native time-series database for telemetry. Prior to the repository-verified 26.06.2 repair, the remediation of `CVE-2026-47735` leaves a cross-database authorization bypass through DuckDB table-valued I/O functions. In `internal/database/sandbox.go`, `allowed_directories` uses `cfg.LocalStorageRoot`, configured by `storage.local_path`, while `enable_external_access=false` blocks access outside that entire multi-tenant root. `GetStoragePath` in `internal/storage/util.go` stores all databases beneath it. In `internal/api/query.go`, `extractTableReferences` skips names followed by an opening parenthesis and `checkQueryPermissions` allows queries with no extracted table references, including tokens with `permissions: []`. The `userSQLReadParquetPattern` denylist catches literal `read_parquet(` and the earlier protection also blocks `arc_partition_agg(`, but misses the `parquet_scan` alias and `glob`, `parquet_metadata`, `parquet_schema`, `read_blob`, `read_csv_auto`, `read_json` and `read_text`. A request to `POST /api/v1/query` using these unblocked functions passes `ValidateSQLRequest` and `convertSQLToStoragePaths` without tenant authorization, allowing reads and enumeration of other databases' time-series data, schema and per-column value-range statistics within the allowlisted root. The sandbox still blocks out-of-root OS files and HTTP SSRF, and the sibling SQLite token database outside the root is not exposed by this mechanism. The earlier 26.06.1 remediation does not comprehensively deny these I/O functions. Repository tag 26.06.2 contains the I/O-function repair and supplies the provisional remediation boundary; conflicting advisory affected-version statements require curator adjudication.","summary":"Arc is an SQL time-series database for telemetry; a crafted SQL request to its query endpoint can use DuckDB file-reading functions to bypass tenant checks. An attacker with a valid token can read other databases' time-series data, schemas and column value-range statistics within the shared storage root.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","arc","multi-tenant","self-hosted","time-series"],"not_affected_if":["single-tenant","version-26.06.2-or-later"],"how_to_check":"- Check the Arc version in use and compare it with the fixed release `26.06.2`.\n- Look for `storage.local_path` in the Arc configuration; a shared multi-tenant root is the exposed setup.\n- Confirm whether the `POST /api/v1/query` endpoint is reachable from untrusted networks.","fix":"- Move to Arc `26.06.2` or later, per the repository tag named in the description.\n- Versions before `26.06.2` are affected; the sources conflict on exact affected ranges.","status":"open","published_at":"2026-10-30T20:17:09+00:00","first_seen_at":"2026-10-30T20:25:38+00:00","triaged_at":"2026-10-30T20:26:49+00:00","updated_at":"2026-10-30T20:26:49+00:00","category":"ai-tooling","confidence":0.6,"triage":{"at":"2026-10-30T20:26:49Z","model":"claude-haiku-5-5","output":{"fix":"- Move to Arc `26.06.2` or later, per the repository tag named in the description.\n- Versions before `26.06.2` are affected; the sources conflict on exact affected ranges.","reach":"network","title":"Arc time-series database: query endpoint lets tenants read other databases","impact":"medium","summary":"Arc is an SQL time-series database for telemetry; a crafted SQL request to its query endpoint can use DuckDB file-reading functions to bypass tenant checks. An attacker with a valid token can read other databases' time-series data, schemas and column value-range statistics within the shared storage root.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["arc","time-series","self-hosted","multi-tenant"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"Tenant reads other databases' time-series data and schemas","analyst_note":"Advisory affected-version statements conflict; confirm the exact vulnerable range and the 26.06.2 fix against the repository tag.","how_to_check":"- Check the Arc version in use and compare it with the fixed release `26.06.2`.\n- Look for `storage.local_path` in the Arc configuration; a shared multi-tenant root is the exposed setup.\n- Confirm whether the `POST /api/v1/query` endpoint is reachable from untrusted networks.","plain_action":"","needs_analyst":true,"not_affected_if":["single-tenant","version-26.06.2-or-later"],"who_is_affected":"Teams running Arc with a shared multi-tenant storage root (`storage.local_path`) where tenants have query tokens. Single-tenant deployments or deployments where query tokens are tightly restricted are less exposed. The advisory notes the affected-version statements conflict, so verify against the fixed tag.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000799,"input_tokens":4644,"output_tokens":669,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A,112C '-47735':113C '-55098':15A,18A '/api/v1/query':225C '26.06.1':291C '26.06.2':106C,302C 'access':141C,144C 'adjud':321C 'advisori':314C 'affect':316C 'affected-vers':315C 'agg':198C 'ai':20B 'ai-tool':19B 'alia':204C 'allow':130C,172C,237C 'allowlist':259C 'also':194C 'arc':1A,22B,32B,87C,196C 'attack':62B 'author':119C,236C 'auto':215C 'beneath':158C 'blob':212C 'block':143C,195C,264C 'boundari':312C 'bypass':58B,120C 'catch':186C 'cfg.localstorageroot':133C 'check':60B 'checkquerypermiss':171C 'column':77B,252C 'comprehens':295C 'configur':134C 'conflict':313C 'contain':303C 'convertsqltostoragepath':233C 'craft':43B 'cross':117C 'cross-databas':116C 'csv':214C 'curat':320C 'cve':13A,16A,111C 'data':74B,247C 'databas':5A,12A,39B,70B,97C,118C,157C,243C,279C 'deni':296C 'denylist':185C 'directori':131C 'duckdb':52B,122C 'earlier':192C,290C 'enabl':139C 'endpoint':7A,49B 'entir':147C 'enumer':240C 'expos':285C 'extern':140C 'extract':176C 'extracttablerefer':162C 'fals':142C 'file':54B,270C 'file-read':53B 'follow':165C 'function':56B,127C,229C,299C 'getstoragepath':152C 'glob':206C 'host':28B 'http':272C 'i/o':126C,298C 'i/o-function':305C 'includ':179C 'internal/api/query.go':161C 'internal/database/sandbox.go':129C 'internal/storage/util.go':154C 'json':217C 'leav':114C 'let':8A 'liter':187C 'mechan':288C 'metadata':208C 'miss':200C 'multi':24B,149C 'multi-ten':23B,148C 'name':164C 'nativ':93C 'open':90C,168C 'os':269C 'out-of-root':265C 'outsid':145C,280C 'parenthesi':169C 'parquet':189C,202C,207C,209C 'partit':197C 'pass':230C 'path':137C 'per':251C 'per-column':250C 'permiss':182C 'post':224C 'prior':100C 'protect':193C 'provision':310C 'queri':6A,48B,173C 'rang':80B,255C 'read':10A,55B,68B,188C,211C,213C,216C,219C,238C 'refer':178C 'remedi':109C,292C,311C 'repair':107C,306C 'repositori':104C,300C 'repository-verifi':103C 'request':45B,222C 'requir':319C 'root':86B,151C,260C,268C,282C 'sandbox':262C 'scan':203C 'schema':75B,210C,248C 'self':27B 'self-host':26B 'seri':4A,31B,38B,73B,96C,246C 'share':84B 'sibl':276C 'skip':163C 'sql':35B,44B,92C 'sql-nativ':91C 'sqlite':277C 'ssrf':273C 'statement':318C 'statist':81B,256C 'still':263C 'storag':85B 'storage.local':136C 'store':155C 'suppli':308C 'tabl':124C,177C 'table-valu':123C 'tag':301C 'telemetri':41B,99C 'tenant':9A,25B,59B,150C,235C 'text':220C 'time':3A,30B,37B,72B,95C,245C 'time-seri':2A,29B,36B,71B,94C,244C 'token':66B,180C,278C 'tool':21B 'unblock':228C 'use':51B,132C,226C 'usersqlreadparquetpattern':184C 'valid':65B 'validatesqlrequest':231C 'valu':79B,125C,254C 'value-rang':78B,253C 'verifi':105C 'version':317C 'within':82B,257C 'without':234C","nicknames":[],"mitigations":[],"who_affected":"Teams running Arc with a shared multi-tenant storage root (`storage.local_path`) where tenants have query tokens. Single-tenant deployments or deployments where query tokens are tightly restricted are less exposed. The advisory notes the affected-version statements conflict, so verify against the fixed tag.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T20:17:09+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-55098","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55098","severity":null,"published_at":"2026-10-30T20:17:09+00:00","modified_at":"2026-10-30T20:17:09+00:00","first_seen_at":"2026-10-30T20:25:38+00:00","fetched_at":"2026-10-30T20:25:38+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}