Basekick-labs Arc vulnerabilities
- basekick-labs arc Arc: DuckDB I/O aliases bypass database RBAC after CVE-2026-47735 6.5 Medium
- basekick-labs arc Arc: Unauthenticated cluster node admission when `cluster.shared_secret` is unset 6.9 Medium
- basekick-labs arc Arc Enterprise cluster replication accepts unauthenticated MsgReplicateSync messages, enabling cluster-wide data injection from any TLS-trusted peer 8.3 High
- basekick-labs arc Arc Enterprise cluster FSM applyRegisterFile accepts arbitrary file paths without validation, enabling cluster-wide path-traversal worm primitive 8.3 High
- basekick-labs arc Arc: Unauthenticated access to Go debug pprof endpoints leaks runtime state and enables CPU-burn DoS 8.8 High
- basekick-labs arc Arc has an authenticated arbitrary local-file read via DuckDB I/O functions that bypasses RBAC table-level checks 7.1 High