{"id":"GHSA-m3qr-fvp4-78xj","kind":"vulnerability","aliases":["GHSA-m3qr-fvp4-78xj"],"related":[],"title":"Arc has unauthenticated application log disclosure via `/api/v1/logs`","description":"## Summary\n\nArc exposes `GET /api/v1/logs` without authentication even when authentication is enabled by default. The route is registered before the global Fiber authentication middleware, and the handler returns recent buffered application logs without performing its own authorization check.\n\n## Details\n\nArc applies the global auth middleware after calling `server.RegisterRoutes()`:\n\n- `cmd/arc/main.go:1598-1599` registers base routes via `server.RegisterRoutes()`.\n- `cmd/arc/main.go:1601-1618` configures and installs `auth.NewMiddleware(...)` later.\n\n`server.RegisterRoutes()` registers `GET /api/v1/logs` as a base route:\n\n- `internal/api/server.go:164-183` registers base health, metrics, and logs routes, including `s.app.Get(\"/api/v1/logs\", s.logsHandler)`.\n\nThe logs handler returns buffered logs without checking authentication or authorization:\n\n- `internal/api/server.go:537-567` parses `limit`, `level`, and `since_minutes`, reads `logger.GetBuffer().GetRecent(...)`, and returns JSON.\n- `internal/logger/buffer.go:9-16` defines log entries returned to callers: timestamp, level, component, message, and caller.\n- `internal/logger/buffer.go:33-39` creates a global log buffer holding the last 10,000 entries.\n- `internal/api/server.go:540-558` permits up to `limit=1000` and `since_minutes=1440` in one unauthenticated request.\n\nAuthentication is enabled by default and `/api/v1/logs` is not listed as a public route:\n\n- `internal/config/config.go:841-843` defaults auth to enabled.\n- `internal/auth/middleware.go:29-41` public defaults are `/health`, `/ready`, `/api/v1/auth/verify`, and `/metrics` prefix; `/api/v1/logs` is not public.\n\nHowever, Fiber route/middleware order makes the later middleware ineffective for an earlier exact route. Local verification against Fiber v2.52.13 showed a route registered before `app.Use(...)` returns `200` and the later middleware is not reached. Fiber’s router walks routes in declaration order and stops after the first matching route unless the handler calls `c.Next()`; `logsHandler` does not call `c.Next()`.\n\n## Proof of concept\n\nSafe local reproduction only; do not scan external infrastructure.\n\n1. Start Arc with default authentication enabled.\n2. Request logs without an `Authorization` header or `x-api-key` header:\n\n```bash\ncurl -i 'http://127.0.0.1:8000/api/v1/logs?limit=1000&since_minutes=1440'\n```\n\nExpected vulnerable result:\n\n```http\nHTTP/1.1 200 OK\nContent-Type: application/json\n\n{\"timestamp\":\"...\",\"count\":...,\"logs\":[...]}\n```\n\n3. Compare with a protected endpoint without credentials:\n\n```bash\ncurl -i 'http://127.0.0.1:8000/api/v1/auth/tokens'\n```\n\nExpected protected result:\n\n```http\nHTTP/1.1 401 Unauthorized\n```\n\nThis demonstrates that default auth is active while `/api/v1/logs` bypasses it due to registration order.\n\n## Impact\n\nAn unauthenticated network attacker can retrieve recent application logs. Depending on deployment and log level, logs can disclose operational metadata such as component names, internal paths, database/measurement names, node identifiers, caller locations, request outcomes, and error details. This can assist further attacks and may expose sensitive data if any deployment logs secrets or user-controlled confidential data.\n\nThe audit did not confirm that the bootstrap admin token banner is captured by this endpoint; that banner is printed with `fmt.Fprintf(os.Stderr, ...)`, while this endpoint reads the zerolog-backed application buffer.\n\n## Workarounds\n\nUntil patched, operators can restrict access to `/api/v1/logs` at a reverse proxy, firewall, ingress policy, or service mesh. If the endpoint is not needed, block it entirely.\n\n## Suggested fix\n\n- Move `/api/v1/logs` registration after global auth middleware and require an authenticated administrator; or\n- Add explicit route-level middleware: `auth.RequireAdmin(authManager)` for `/api/v1/logs`; and\n- Add a regression test that unauthenticated requests to `/api/v1/logs` return 401/403 while `/health` and `/ready` remain public.\n\n## References / evidence\n\n- `cmd/arc/main.go:1598-1618`\n- `internal/api/server.go:164-183`\n- `internal/api/server.go:537-567`\n- `internal/auth/middleware.go:29-41`\n- `internal/config/config.go:841-843`\n- `internal/logger/buffer.go:9-16`\n- `internal/logger/buffer.go:33-39`","summary":"Arc registers its /api/v1/logs route before the global authentication middleware, so the route skips auth even when auth is enabled by default. An unauthenticated network attacker can read recent buffered application logs, which may include component names, internal paths, node identifiers and error details.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/basekick-labs/arc","fixed":["0.0.0-20260615165136-bb7d9761ad98"],"affected":"< 0.0.0-20260615165136-bb7d9761ad98","ecosystem":"go"}],"ecosystems":["go"],"tags":["ai-tooling","arc","cwe-200","cwe-306","go","self-hosted"],"not_affected_if":["api-not-network-reachable","endpoint-blocked-at-proxy","fixed-version"],"how_to_check":"- Request `/api/v1/logs` with no `Authorization` or `x-api-key` header against your Arc instance; a `200` response instead of `401` means the route is exposed.\n- Check that the Arc version in use is older than `0.0.0-20260615165136-bb7d9761ad98`.","fix":"- Upgrade the Go module `github.com/basekick-labs/arc` to `0.0.0-20260615165136-bb7d9761ad98` or later.\n- Until patched, the advisory suggests restricting `/api/v1/logs` at a reverse proxy, firewall, ingress or service mesh, or blocking it entirely if not needed.","status":"open","published_at":"2026-11-03T16:29:38+00:00","first_seen_at":"2026-11-03T16:30:30+00:00","triaged_at":"2026-11-03T16:31:59+00:00","updated_at":"2026-11-03T16:31:59+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-11-03T16:31:59Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the Go module `github.com/basekick-labs/arc` to `0.0.0-20260615165136-bb7d9761ad98` or later.\n- Until patched, the advisory suggests restricting `/api/v1/logs` at a reverse proxy, firewall, ingress or service mesh, or blocking it entirely if not needed.","reach":"network","title":"Arc: unauthenticated request returns recent application logs via /api/v1/logs","impact":"low","summary":"Arc registers its /api/v1/logs route before the global authentication middleware, so the route skips auth even when auth is enabled by default. An unauthenticated network attacker can read recent buffered application logs, which may include component names, internal paths, node identifiers and error details.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["arc","go","self-hosted"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"unauthenticated attacker reads recent application logs with internal details","analyst_note":"","how_to_check":"- Request `/api/v1/logs` with no `Authorization` or `x-api-key` header against your Arc instance; a `200` response instead of `401` means the route is exposed.\n- Check that the Arc version in use is older than `0.0.0-20260615165136-bb7d9761ad98`.","plain_action":"","needs_analyst":false,"not_affected_if":["fixed-version","endpoint-blocked-at-proxy","api-not-network-reachable"],"who_is_affected":"Any Arc deployment with default authentication enabled that is reachable from a network where an attacker can send requests to its API port. The exposed data is the application log buffer, so deployments that log secrets or confidential user data face higher risk. Deployments where the API is only reachable behind a proxy that already blocks /api/v1/logs, or that are on a fixed version, can skip it.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"low"},"cost_usd":0.000925,"input_tokens":5815,"output_tokens":686,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-1599':128C '-16':192C '-1618':136C '-183':152C '-200':27B '-306':29B '-39':207C '-41':258C '-558':221C '-567':177C '-843':251C '/api/v1/auth/verify':264C '/api/v1/logs':8A,37B,82C,145C,162C,241C,268C,415C,522C,545C,566C,576C '/basekick-labs/arc':21A '/health':262C,580C '/metrics':266C '/ready':263C,582C '000':217C '1':343C '10':216C '1000':226C,369C '127.0.0.1':366C,398C '1440':230C,372C '1598':127C '1601':135C '164':151C '2':350C '200':298C,378C '29':257C '3':387C '33':206C '401':405C '401/403':578C '537':176C '540':220C '78xj':13A,18A '8000/api/v1/auth/tokens':399C '8000/api/v1/logs':367C '841':250C '9':191C 'access':520C 'activ':413C 'add':557C,568C 'admin':489C 'administr':555C 'ai':23B 'ai-tool':22B 'api':360C 'app.use':296C 'appli':118C 'applic':4A,64B,108C,430C,512C 'application/json':383C 'arc':1A,25B,34B,79C,117C,345C 'assist':462C 'attack':59B,426C,464C 'audit':482C 'auth':48B,51B,121C,253C,411C,549C 'auth.newmiddleware':140C 'auth.requireadmin':563C 'authent':42B,84C,87C,100C,172C,235C,348C,554C 'authmanag':564C 'author':114C,174C,355C 'back':511C 'banner':491C,498C 'base':130C,148C,154C 'bash':363C,395C 'block':539C 'bootstrap':488C 'buffer':63B,107C,168C,212C,513C 'bypass':416C 'c.next':325C,330C 'call':124C,324C,329C 'caller':198C,204C,453C 'captur':493C 'check':115C,171C 'cmd/arc/main.go':126C,134C 'compar':388C 'compon':69B,201C,445C 'concept':333C 'confidenti':479C 'configur':137C 'confirm':485C 'content':381C 'content-typ':380C 'control':478C 'count':385C 'creat':208C 'credenti':394C 'curl':364C,396C 'cwe':26B,28B 'data':469C,480C 'database/measurement':449C 'declar':312C 'default':55B,91C,239C,252C,260C,347C,410C 'defin':193C 'demonstr':408C 'depend':432C 'deploy':434C,472C 'detail':77B,116C,459C 'disclos':440C 'disclosur':6A 'due':418C 'earlier':283C 'enabl':53B,89C,237C,255C,349C 'endpoint':392C,496C,506C,535C 'entir':541C 'entri':195C,218C 'error':76B,458C 'even':49B,85C 'exact':284C 'expect':373C,400C 'explicit':558C 'expos':80C,467C 'extern':341C 'fiber':99C,273C,289C,306C 'firewal':527C 'first':318C 'fix':543C 'fmt.fprintf':502C 'fvp4':12A,17A 'get':81C,144C 'getrec':186C 'ghsa':10A,15A 'ghsa-m3qr-fvp4-78xj':9A,14A 'github.com':20A 'github.com/basekick-labs/arc':19A 'global':41B,98C,120C,210C,548C 'go':30B 'handler':104C,166C,323C 'header':356C,362C 'health':155C 'hold':213C 'host':33B 'howev':272C 'http':376C,403C 'http/1.1':377C,404C 'identifi':74B,452C 'impact':422C 'includ':68B,160C 'ineffect':280C 'infrastructur':342C 'ingress':528C 'instal':139C 'intern':71B,447C 'internal/api/server.go':150C,175C,219C 'internal/auth/middleware.go':256C 'internal/config/config.go':249C 'internal/logger/buffer.go':190C,205C 'json':189C 'key':361C 'last':215C 'later':141C,278C,301C 'level':180C,200C,437C,561C 'limit':179C,225C,368C 'list':244C 'local':286C,335C 'locat':454C 'log':5A,65B,109C,158C,165C,169C,194C,211C,352C,386C,431C,436C,438C,473C 'logger.getbuffer':185C 'logshandl':326C 'm3qr':11A,16A 'make':276C 'match':319C 'may':67B,466C 'mesh':532C 'messag':202C 'metadata':442C 'metric':156C 'middlewar':43B,101C,122C,279C,302C,550C,562C 'minut':183C,229C,371C 'move':544C 'name':70B,446C,450C 'need':538C 'network':58B,425C 'node':73B,451C 'ok':379C 'one':232C 'oper':441C,517C 'order':275C,313C,421C 'os.stderr':503C 'outcom':456C 'pars':178C 'patch':516C 'path':72B,448C 'perform':111C 'permit':222C 'polici':529C 'prefix':267C 'print':500C 'proof':331C 'protect':391C,401C 'proxi':526C 'public':247C,259C,271C 'reach':305C 'read':61B,184C,507C 'recent':62B,106C,429C 'regist':35B,95C,129C,143C,153C,294C 'registr':420C,546C 'regress':570C 'rema':583C 'reproduct':336C 'request':234C,351C,455C,574C 'requir':552C 'restrict':519C 'result':375C,402C 'retriev':428C 'return':105C,167C,188C,196C,297C,577C 'revers':525C 'rout':38B,46B,93C,131C,149C,159C,248C,285C,293C,310C,320C,560C 'route-level':559C 'route/middleware':274C 'router':308C 's.app.get':161C 's.logshandler':163C 'safe':334C 'scan':340C 'secret':474C 'self':32B 'self-host':31B 'sensit':468C 'server.registerroutes':125C,133C,142C 'servic':531C 'show':291C 'sinc':182C,228C,370C 'skip':47B 'start':344C 'stop':315C 'suggest':542C 'summari':78C 'test':571C 'timestamp':199C,384C 'token':490C 'tool':24B 'type':382C 'unauthent':3A,57B,233C,424C,573C 'unauthor':406C 'unless':321C 'user':477C 'user-control':476C 'v2.52.13':290C 'verif':287C 'via':7A,132C 'vulner':374C 'walk':309C 'without':83C,110C,170C,353C,393C 'workaround':514C 'x':359C 'x-api-key':358C 'zerolog':510C 'zerolog-back':509C","nicknames":[],"mitigations":[],"who_affected":"Any Arc deployment with default authentication enabled that is reachable from a network where an attacker can send requests to its API port. The exposed data is the application log buffer, so deployments that log secrets or confidential user data face higher risk. Deployments where the API is only reachable behind a proxy that already blocks /api/v1/logs, or that are on a fixed version, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["githubcombasekicklabsarc"],"ptokens":["arc","basekick","com","github","labs"],"labels":["aitooling","arc","cwe200","cwe306","go","low","selfhosted"],"first_public_at":"2026-11-03T16:29:38+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-m3qr-fvp4-78xj","url":"https://github.com/advisories/GHSA-m3qr-fvp4-78xj","severity":"low","published_at":"2026-11-03T16:29:38+00:00","modified_at":"2026-11-03T16:29:38+00:00","first_seen_at":"2026-11-03T16:30:30+00:00","fetched_at":"2026-11-03T16:40:35+00:00","note":null}],"documents":[{"id":58890,"url":"https://api.github.com/repos/Basekick-Labs/arc/security-advisories/GHSA-m3qr-fvp4-78xj","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"},{"id":58891,"url":"https://github.com/Basekick-Labs/arc/security/advisories/GHSA-m3qr-fvp4-78xj","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"},{"id":58892,"url":"https://github.com/Basekick-Labs/arc/pull/506","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":58893,"url":"https://github.com/Basekick-Labs/arc/commit/bb7d9761ad9801e93837762ff7d37460f1df19dd","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":58894,"url":"https://github.com/Basekick-Labs/arc/releases/tag/v26.06.2","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}