{"id":"CVE-2026-48050","title":"Arc is an open, SQL-native time-series database for telemetry","summary":"Arc is an open, SQL-native time-series database for telemetry. Versions prior to 26.06.1 register Go's `net/http/pprof` handlers at `/debug/pprof/*` via `app.Use(pprof.New())` in `internal/api/server.go`, and `/debug/pprof` is added to `…","severity":"high","cvss":8.2,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","cwe":["CWE-200","CWE-306","CWE-400"],"vendor":"Red Hat","product":"Red Hat Edge Manager 1","affected":["aws_load_balancer_operator","exploit_intelligence","multicluster_engine_for_kubernetes","openshift_api_for_data_protection","openshift_pipelines","ceph_storage 5","ceph_storage 6","ceph_storage 7","ceph_storage 8","ceph_storage 9","certification_program_for_red_hat_enterprise_linux 9","connectivity_link 1","developer_hub","edge_manager 1","openshift_ai_rhoai","openshift_container_platform 4","openshift_gitops","trusted_artifact_signer","secrets_management_console_for_red_hat_openshift","zero_trust_workload_identity_manager_tech_preview"],"patched":["github.com/basekick-labs/arc 0.0.0-20260520170331-32a4091fb949"],"published":"2026-08-21","updated":"2026-09-09","sourceUpdated":"2026-09-09T21:06:39.057","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-48050","references":[{"url":"https://github.com/Basekick-Labs/arc/commit/32a4091fb949f9cf060cdd804a07f6450dc426a8","label":"security-advisories@github.com"},{"url":"https://github.com/Basekick-Labs/arc/releases/tag/v26.06.1","label":"security-advisories@github.com"},{"url":"https://github.com/Basekick-Labs/arc/security/advisories/GHSA-j93g-rp6m-j32m","label":"security-advisories@github.com"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48050.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-48050"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2521251"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-48050"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48050"},{"url":"https://github.com/advisories/GHSA-j93g-rp6m-j32m"}],"tags":["nvd","csaf","vex","red-hat","ghsa","go"],"epss":0.00358,"epssPercentile":0.29546,"aliases":["GHSA-j93g-rp6m-j32m"],"ecosystem":"go","cvssSource":"vendor","ingestedAt":"2026-07-07T15:41:59.301Z","slug":"CVE-2026-48050","body":"## Overview\n\nArc is an open, SQL-native time-series database for telemetry. Versions prior to 26.06.1 register Go's `net/http/pprof` handlers at `/debug/pprof/*` via `app.Use(pprof.New())` in `internal/api/server.go`, and `/debug/pprof` is added to `PublicPrefixes` in `cmd/arc/main.go`. The auth middleware short-circuits before the token check on prefix match, so the endpoints are reachable without any authentication. Version 26.06.1 contains a patch. Some workarounds are available. Block `/debug/pprof*` at a reverse proxy / load balancer in front of Arc, restrict Arc's API port to known-trusted networks via firewall rules, and/or patch the running build: comment out `app.Use(pprof.New())` in `internal/api/server.go` and rebuild.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-48050)\n\nAffected packages:\n\n- `github.com/basekick-labs/arc < 0.0.0-20260520170331-32a4091fb949`\n\nPatched in:\n\n- `github.com/basekick-labs/arc 0.0.0-20260520170331-32a4091fb949`\n\nSource: https://github.com/advisories/GHSA-j93g-rp6m-j32m\n\n## Vendor advisories\n\n- **Red Hat VEX** · Important · affected: AWS Load Balancer Operator, Exploit Intelligence, Multicluster Engine for Kubernetes, OpenShift API for Data Protection, OpenShift Pipelines, Red Hat Ceph Storage 5, … · no fix planned: Multicluster Engine for Kubernetes, OpenShift API for Data Protection, Red Hat OpenShift Container Platform 4, Secrets Management Console for Red Hat OpenShift, … · updated 2026-09-09 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48050.json)","depth":"twilight","depthScore":45,"depthScoreParts":{"impact":45.1,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":5269,"id":"CVE-2026-48050","ts":1788887258210,"field":"cvss","old":null,"new":"8.2"},{"seq":4152,"id":"CVE-2026-48050","ts":1788886374806,"field":"cvss","old":"8.2","new":null},{"seq":3188,"id":"CVE-2026-48050","ts":1788883133382,"field":"cvss","old":null,"new":"8.2"}]}