CVE-2026-55098: CVE-2026-55098: Cross-Database Authorization Bypass via DuckDB Table-Valued I/O Functions in Basekick-Labs Arc

#security #cve #cybersecurity

CVE-2026-55098: Cross-Database Authorization Bypass via DuckDB Table-Valued I/O Functions in Basekick-Labs Arc

Vulnerability ID: CVE-2026-55098
CVSS Score: 6.5
Published: 2026-11-04

CVE-2026-55098 (GHSA-93cm-2v4m-c56c) is an authorization bypass and sensitive information disclosure vulnerability in Basekick-Labs Arc prior to version 26.06.2. The flaw stems from an incomplete remediation of CVE-2026-47735, which failed to restrict the full suite of DuckDB table-valued filesystem I/O functions and quoted-identifier invocations. Because Arc's query parser ignores function calls during table reference extraction, authenticated users with minimal or empty permissions can invoke functions like parquet_scan(), glob(), and read_blob() to read, enumerate, and extract telemetry data across all tenant databases residing within the shared local storage root.

TL;DR

An incomplete denylist in Basekick-Labs Arc prior to v26.06.2 allows any authenticated user to bypass database-level RBAC by invoking unblocked DuckDB filesystem I/O functions (such as parquet_scan and glob) or quoted identifiers, enabling full read access to all tenant databases in the shared storage directory.

⚠️ Exploit Status: POC

Technical Details

Vulnerability Type: Incorrect Authorization / Cross-Tenant Data Disclosure (CWE-863, CWE-200)
Affected Component: SQL Query Validator (internal/api/query.go) & Token Auth (internal/auth/auth.go)
Attack Vector: Network via authenticated HTTP POST to /api/v1/query
CVSS v3.1 Score: 6.5 Medium (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
EPSS Score: 0.319% (25.03rd Percentile)
Impact: Unauthorized read access and directory enumeration across all tenant databases in cfg.LocalStorageRoot
Exploit Status: Proof-of-Concept available in repository test suite
Fixed Version: Arc v26.06.2

Affected Systems

Basekick-Labs Arc
Arc: < 26.06.2 (Fixed in: 26.06.2)

Code Analysis

Commit: 5dc8f53

fix(security): block DuckDB I/O function family in user SQL (GHSA-93cm-2v4m-c56c) (#495)

File: internal/api/query.go
@@ -2055,41 +2055,115 @@ func ValidateSQLRequest(sql string) error {
-   if userSQLReadParquetPattern.MatchString(normalised) {
-       return &SQLValidationError{Message: "Direct read_parquet() calls are not allowed in user SQL"}
-   }
-
-   if userSQLArcPartitionAggPattern.MatchString(normalised) {
-       return &SQLValidationError{Message: "Direct arc_partition_agg() calls are not allowed in user SQL"}
+   ioCheckNormalised := ioDenylistNormalise(sql)
+   if m := ioTableFunctionPattern.FindStringSubmatch(ioCheckNormalised); m != nil {
+       return &SQLValidationError{Message: "File I/O function not allowed in user SQL: " + m[1] + "()"}
    }

Exploit Details

GitHub: Regression test suite in internal/api/query_test.go demonstrating cross-database bypass payloads using parquet_scan, glob, read_blob, and quoted identifiers.

Mitigation Strategies

Upgrade Basekick-Labs Arc to version 26.06.2 or later to enforce the comprehensive DuckDB I/O function denylist and proper quote normalization.
Audit and rotate API tokens created with empty permission arrays ('permissions': []) prior to v26.06.2, as they were silently granted 'read,write' access.
Deploy Web Application Firewall (WAF) or reverse proxy rules to inspect POST /api/v1/query payloads and reject requests containing DuckDB filesystem table functions.
Isolate sensitive tenants into separate Arc instances with dedicated local storage directories where strict multi-tenant physical separation is required.

Remediation Steps:

Pull and deploy the Basekick-Labs Arc v26.06.2 release binary or container image (containing commit 5dc8f53b70a3871b16b0cebf328f07c578af7a45).
Inspect the authentication token database to identify tokens intended to be RBAC-only that currently possess 'read,write' permissions, and recreate or revoke them.
Verify that user SQL queries invoking parquet_scan(), glob(), read_blob(), or quoted variants return a SQLValidationError.

References

Read the full report for CVE-2026-55098 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community