---
id: "CVE-2026-55098"
kind: "vulnerability"
aliases: ["CVE-2026-55098"]
title: "Arc time-series database: query endpoint lets tenants read other databases"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["ai-tooling", "arc", "multi-tenant", "self-hosted", "time-series"]
not_affected_if: ["single-tenant", "version-26.06.2-or-later"]
published_at: "2026-10-30T20:17:09+00:00"
first_seen_at: "2026-10-30T20:25:38+00:00"
updated_at: "2026-10-30T20:26:49+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55098", "first_seen_at": "2026-10-30T20:25:38+00:00"}]
---

# Arc time-series database: query endpoint lets tenants read other databases

Arc is an SQL time-series database for telemetry; a crafted SQL request to its query endpoint can use DuckDB file-reading functions to bypass tenant checks. An attacker with a valid token can read other databases' time-series data, schemas and column value-range statistics within the shared storage root.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Arc version in use and compare it with the fixed release `26.06.2`.
- Look for `storage.local_path` in the Arc configuration; a shared multi-tenant root is the exposed setup.
- Confirm whether the `POST /api/v1/query` endpoint is reachable from untrusted networks.

## Fix

- Move to Arc `26.06.2` or later, per the repository tag named in the description.
- Versions before `26.06.2` are affected; the sources conflict on exact affected ranges.

## Timeline

- 2026-10-30T20:25:38+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-55098

## From the sources

Arc is an open, SQL-native time-series database for telemetry. Prior to the repository-verified 26.06.2 repair, the remediation of `CVE-2026-47735` leaves a cross-database authorization bypass through DuckDB table-valued I/O functions. In `internal/database/sandbox.go`, `allowed_directories` uses `cfg.LocalStorageRoot`, configured by `storage.local_path`, while `enable_external_access=false` blocks access outside that entire multi-tenant root. `GetStoragePath` in `internal/storage/util.go` stores all databases beneath it. In `internal/api/query.go`, `extractTableReferences` skips names followed by an opening parenthesis and `checkQueryPermissions` allows queries with no extracted table references, including tokens with `permissions: []`. The `userSQLReadParquetPattern` denylist catches literal `read_parquet(` and the earlier protection also blocks `arc_partition_agg(`, but misses the `parquet_scan` alias and `glob`, `parquet_metadata`, `parquet_schema`, `read_blob`, `read_csv_auto`, `read_json` and `read_text`. A request to `POST /api/v1/query` using these unblocked functions passes `ValidateSQLRequest` and `convertSQLToStoragePaths` without tenant authorization, allowing reads and enumeration of other databases' time-series data, schema and per-column value-range statistics within the allowlisted root. The sandbox still blocks out-of-root OS files and HTTP SSRF, and the sibling SQLite token database outside the root is not exposed by this mechanism. The earlier 26.06.1 remediation does not comprehensively deny these I/O functions. Repository tag 26.06.2 contains the I/O-function repair and supplies the provisional remediation boundary; conflicting advisory affected-version statements require curator adjudication.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_