Vulnerabilities

Vulnerability · GHSA-m3qr-fvp4-78xj

Arc has unauthenticated application log disclosure via

Published Nov 3, 2026 · catalog updated Nov 3, 2026 · Arc has unauthenticated application

Last checked Nov 5, 2026. A connected source was read within the last 7 days.

Open the advisory

Exploitation likelihood is not on this record for GHSA-m3qr-fvp4-78xj. A missing EPSS score is not a low risk. Compare Arc has unauthenticated application with the linked advisory before you change production.

Severity

Low—

Known exploitation

Not in CISA/VulnCheck KEV

EPSS

Awaiting synchronization with FIRST

Remediation

Version ranges on file

Affected products

Go github.com/basekick-labs/arc · go github.com/basekick-labs/arc

## Summary Arc exposes without authentication even when authentication is enabled by default. The route is registered before the global Fiber authentication middleware, and the handler returns recent buffered application logs without performing its own authorization check. ## Details Arc applies the global auth middleware after calling : - registers base routes via . - configures and installs later. registers as a base route: - registers base health, metrics, and logs routes, including . The logs handler returns buffered logs without checking authentication or authorization: - parses , , and , reads , and returns JSON. - defines log entries returned to callers: timestamp, level, component, message, and caller. - creates a global log buffer holding the last 10,000 entries. - permits up to and in one unauthenticated request. Authentication is enabled by default and is not listed as a public route: - defaults auth to enabled. - public defaults are , , , and prefix; is not public. However, Fiber route/middleware order makes the later middleware ineffective for an earlier exact route. Local verification against Fiber v2.52.13 showed a route registered before returns and the later middleware is not reached. Fiber’s router walks routes in declaration order and stops after the first matching route unless the handler calls ; does not call . ## Proof of concept Safe local reproduction only; do not scan external infrastructure. 1. Start Arc with default authentication enabled. 2. Request logs without an header or header: Expected vulnerable result: 3. Compare with a protected endpoint without credentials: Expected protected result: This demonstrates that default auth is active while bypasses it due to registration order. ## Impact An unauthenticated network attacker can retrieve recent application logs. Depending on deployment and log level, logs can disclose operational metadata such as component names, internal paths, database/measurement names, node identifiers, caller loca