SQL Injection Vulnerability in Arc Time-Series Database by Basekick Labs

CVE-2026-47735

What is CVE-2026-47735?

Arc, an open SQL-native time-series database for telemetry, had a security flaw prior to version 26.06.1. The user-SQL validator did not block multiple DuckDB I/O function families, allowing potential SQL injection vulnerabilities. The extraction of RBAC table references was limited to 'FROM' and 'JOIN' clauses, bypassing security checks for scalar functions in the 'SELECT' list. This issue was remedied in version 26.06.1 through the implementation of a structural sandbox that restricts operations to an allowlist, effectively mitigating the risk of unauthorized file access. Users are encouraged to restrict API access to trusted networks and apply temporary mitigation strategies while upgrading.

References