Summary
Arc has an authenticated arbitrary local-file read via DuckDB I/O functions that bypasses RBAC table-level checks
Arc's user-SQL validator (internal/api/query.go:ValidateSQLRequest) blocked only read_parquet( and arc_partition_agg( via regex denylist. The broader DuckDB I/O function family, read_csv_auto, read_csv, read_json, read_json_auto, read_text, read_blob, glob, parquet_metadata, parquet_schema, read_xlsx, etc., was not blocked. RBAC table-reference extraction inspected only FROM/JOIN clauses, so scalar table functions in the SELECT list slipped past both layers.
Workarounds
- Restrict API access to known-trusted networks via firewall rules.
- Temporary mitigation: add
read_csv*/read_json*/globetc. todangerousSQLPatternininternal/api/query.gopending 2026.06.1.
Credits
Reported by Alex Manson (@NeuroWinter, https://neurowinter.com/) on 2026-05-19.
Impact
Any authenticated user, including a token with permissions: [], can read arbitrary local files via:
POST /api/v1/query
Authorization: Bearer <token>
{"sql": "SELECT * FROM read_csv_auto('/etc/passwd', header=false, columns={'l':'VARCHAR'}) LIMIT 5"}
Confirmed reachable targets:
auth.db, bcrypt hashes for every API token, plus legacy SHA-256 rows.arc.toml, S3 secrets, TLS keys./proc/self/environ, environment-variable secrets.- Cross-tenant Parquet files, bypasses RBAC because the tenant scope is enforced at the table layer, not on raw file paths.
- SSRF when
httpfsis loaded (any S3-backed deployment),read_csv_auto('http://169.254.169.254/latest/meta-data/...')reaches instance metadata IPs.
Input manipulates file paths to reach files outside the intended directory, such as configuration or credential files. Typical impact: unauthorized file read or write outside the intended directory.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
Fixed in 2026.06.1 (PR #442) via a structural sandbox at the DuckDB layer:
SET GLOBAL allowed_directories = [...]enumerates Arc's legitimate filesystem prefixes (storage roots + tier prefixes + import upload dir + compaction temp).SET GLOBAL enable_external_access = false(one-way at runtime).- Verified by reading back the flag.
After lockdown, DuckDB refuses to open any file outside the allowlist and refuses further INSTALL/LOAD. Already-loaded extensions remain callable.
Frequently Asked Questions
- What is CVE-2026-47735? CVE-2026-47735 is a high-severity path traversal vulnerability in github.com/basekick-labs/arc (go), affecting versions < 0.0.0-20260520141557-91bdc29d1a02. It is fixed in 0.0.0-20260520141557-91bdc29d1a02. Input manipulates file paths to reach files outside the intended directory, such as configuration or credential files.
- Which versions of github.com/basekick-labs/arc are affected by CVE-2026-47735? github.com/basekick-labs/arc (go) versions < 0.0.0-20260520141557-91bdc29d1a02 is affected.
- Is there a fix for CVE-2026-47735? Yes. CVE-2026-47735 is fixed in 0.0.0-20260520141557-91bdc29d1a02. Upgrade to this version or later.
- Is CVE-2026-47735 exploitable, and should I be worried? Whether CVE-2026-47735 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2026-47735 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2026-47735? Upgrade
github.com/basekick-labs/arcto 0.0.0-20260520141557-91bdc29d1a02 or later.