Cross-Database Authorization Bypass in Arc by Basekick Labs

CVE-2026-55098

What is CVE-2026-55098?

The Arc database prior to version 26.06.2 has a vulnerability that allows for a cross-database authorization bypass via improper SQL query handling. This occurs when certain table-valued I/O functions are not adequately restricted. Users can exploit these functions to obtain unauthorized access to time-series data residing in other databases under the same multi-tenant root, thus exposing sensitive information. Although initial patches were implemented, they did not effectively address all avenues of access, leading to potential data leakage scenarios. Users are advised to upgrade to the latest version for enhanced security.

References