CVE-2026-48050

CVE-2026-48050 is a high-severity missing authentication for critical function vulnerability in github.com/basekick-labs/arc (go), affecting versions < 0.0.0-20260520170331-32a4091fb949. It is fixed in 0.0.0-20260520170331-32a4091fb949.

Does this CVE actually affect you?

Kodem shows which CVEs are reachable and running in your applications, so you fix what's exploitable, not just what's listed.

Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.

Runtime intelligence, not another scanner.

Summary

Arc: Unauthenticated access to Go debug pprof endpoints leaks runtime state and enables CPU-burn DoS

Arc registers Go's net/http/pprof handlers at /debug/pprof/* via app.Use(pprof.New()) in internal/api/server.go, and /debug/pprof is added to PublicPrefixes in cmd/arc/main.go. The auth middleware short-circuits before the token check on prefix match, so the endpoints are reachable without any authentication.

Workarounds

  • Block /debug/pprof* at a reverse proxy / load balancer in front of Arc.
  • Restrict Arc's API port to known-trusted networks via firewall rules.
  • Patch the running build: comment out app.Use(pprof.New()) in internal/api/server.go and rebuild.

Credits

Reported by Alex Manson (@NeuroWinter, https://neurowinter.com/) on 2026-05-19.

Impact

Any network-reachable caller (no token required) can:

  • Fetch /debug/pprof/heap, leaks in-memory state: live SQL strings, decoded msgpack records, decompressed request bodies, cached *TokenInfo (the auth cache keys on SHA-256 of the plaintext token at auth.go:543).
  • Fetch /debug/pprof/goroutine?debug=2, leaks call stacks, identifying internal code paths.
  • Fetch /debug/pprof/profile?seconds=N, pins a CPU core for arbitrary duration. Trivial DoS amplification (one short HTTP request → minutes of server CPU).
  • Fetch /debug/pprof/trace, long-duration execution trace, similar DoS profile.

No authentication, no rate limiting, no resource bound on the seconds parameter.

A critical operation is accessible without requiring any authentication. Typical impact: any user can invoke the privileged function.

Affected versions

github.com/basekick-labs/arc (< 0.0.0-20260520170331-32a4091fb949)

Security releases

github.com/basekick-labs/arc → 0.0.0-20260520170331-32a4091fb949 (go)

Kodem intelligence

Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.

Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.

Already deployed Kodem?

See it in your environmentNew to Kodem? Get a demo →

Remediation advice

https://github.com/Basekick-Labs/arc/releases/tag/v26.06.1

Planned mitigation:

  1. Gate pprof registration behind an env var (ARC_DEBUG_PPROF=1) that defaults to off.
  2. When enabled, bind pprof to a separate localhost-only listener (127.0.0.1:6060 via dedicated net/http server) so it's never reachable from the public API port.
  3. Remove /debug/pprof from PublicPrefixes.
  4. Fix the HasPrefix bug where "/debug/pprofX" matches "/debug/pprof".

Frequently Asked Questions

  1. What is CVE-2026-48050? CVE-2026-48050 is a high-severity missing authentication for critical function vulnerability in github.com/basekick-labs/arc (go), affecting versions < 0.0.0-20260520170331-32a4091fb949. It is fixed in 0.0.0-20260520170331-32a4091fb949. A critical operation is accessible without requiring any authentication.
  2. Which versions of github.com/basekick-labs/arc are affected by CVE-2026-48050? github.com/basekick-labs/arc (go) versions < 0.0.0-20260520170331-32a4091fb949 is affected.
  3. Is there a fix for CVE-2026-48050? Yes. CVE-2026-48050 is fixed in 0.0.0-20260520170331-32a4091fb949. Upgrade to this version or later.
  4. Is CVE-2026-48050 exploitable, and should I be worried? Whether CVE-2026-48050 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
  5. What actually determines whether CVE-2026-48050 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
  6. How do I fix CVE-2026-48050? Upgrade github.com/basekick-labs/arc to 0.0.0-20260520170331-32a4091fb949 or later.

Other vulnerabilities in github.com/basekick-labs/arc

CVE-IDSeverityPackage summary
CVE-2026-47735Highgithub.com/basekick-labs/arc: Arc has an authenticated arbitrary local-file read via DuckDB I/O functions that bypasses RBAC table-level checks

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo