Basekick-Labs arc

• CVE-2026-55098 Medium 6.5 Arc: DuckDB I/O aliases bypass database RBAC after CVE-2026-47735 0.3%
• CVE-2026-55678 Medium 6.9 Arc: Unauthenticated cluster node admission when `cluster.shared_secret` is unset 0.7%
• CVE-2026-48106 High 8.3 Arc Enterprise cluster replication accepts unauthenticated MsgReplicateSync messages, enabling cluster-wide data injection from any TLS-trusted peer 0.2%
• CVE-2026-48105 High 8.3 Arc Enterprise cluster FSM applyRegisterFile accepts arbitrary file paths without validation, enabling cluster-wide path-traversal worm primitive 0.2%
• CVE-2026-47735 High 7.1 Arc has an authenticated arbitrary local-file read via DuckDB I/O functions that bypasses RBAC table-level checks 0.4%
• CVE-2026-48050 High 8.8 Arc: Unauthenticated access to Go debug pprof endpoints leaks runtime state and enables CPU-burn DoS 0.6%