GHSA-m3qr-fvp4-78xj: Arc has unauthenticated application log disclosure via `/api/v1/logs`

November 3, 2026

Arc exposes GET /api/v1/logs without authentication even when authentication is enabled by default. The route is registered before the global Fiber authentication middleware, and the handler returns recent buffered application logs without performing its own authorization check.

References

github.com/Basekick-Labs/arc/commit/bb7d9761ad9801e93837762ff7d37460f1df19dd
github.com/Basekick-Labs/arc/pull/506
github.com/Basekick-Labs/arc/releases/tag/v26.06.2
github.com/Basekick-Labs/arc/security/advisories/GHSA-m3qr-fvp4-78xj
github.com/advisories/GHSA-m3qr-fvp4-78xj

Code Behaviors & Features

Detect and mitigate GHSA-m3qr-fvp4-78xj with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →