CVE-2026-55098: Arc: DuckDB I/O aliases bypass database RBAC after CVE-2026-47735
The fix for CVE-2026-47735 (released 2026.06.1) is incomplete. It added a DuckDB sandbox (SET GLOBAL allowed_directories=[<storage root>]; SET GLOBAL enable_external_access=false) and an Arc SQL-layer denylist of the literal functions read_parquet( and arc_partition_agg(. The sandbox correctly blocks reads outside the storage root (OS files, http:// SSRF), but it allowlists the entire multi-tenant storage root, and the SQL denylist still misses the rest of the DuckDB I/O family the original advisory enumerated. As a result, any authenticated token — including one with permissions: [] — can read or enumerate every other database’s data within the deployment, defeating RBAC.
Verified at HEAD c08b892 (v26.06.1-36, includes 26.06.2). Confirmed still live; no later commit blocks these functions.
References
- github.com/Basekick-Labs/arc/commit/5dc8f53b70a3871b16b0cebf328f07c578af7a45
- github.com/Basekick-Labs/arc/pull/495
- github.com/Basekick-Labs/arc/security/advisories/GHSA-93cm-2v4m-c56c
- github.com/Basekick-Labs/arc/tree/v26.06.2
- github.com/advisories/GHSA-93cm-2v4m-c56c
- nvd.nist.gov/vuln/detail/CVE-2026-55098
Code Behaviors & Features
Detect and mitigate CVE-2026-55098 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →