GHSA-M3QR-FVP4-78XJ

Vulnerability from github – Published: 2026-11-03 16:29 – Updated: 2026-11-03 16:29
VLAI
Summary
Arc has unauthenticated application log disclosure via `/api/v1/logs`
Details

Summary

Arc exposes GET /api/v1/logs without authentication even when authentication is enabled by default. The route is registered before the global Fiber authentication middleware, and the handler returns recent buffered application logs without performing its own authorization check.

Details

Arc applies the global auth middleware after calling server.RegisterRoutes():

  • cmd/arc/main.go:1598-1599 registers base routes via server.RegisterRoutes().
  • cmd/arc/main.go:1601-1618 configures and installs auth.NewMiddleware(...) later.

server.RegisterRoutes() registers GET /api/v1/logs as a base route:

  • internal/api/server.go:164-183 registers base health, metrics, and logs routes, including s.app.Get("/api/v1/logs", s.logsHandler).

The logs handler returns buffered logs without checking authentication or authorization:

  • internal/api/server.go:537-567 parses limit, level, and since_minutes, reads logger.GetBuffer().GetRecent(...), and returns JSON.
  • internal/logger/buffer.go:9-16 defines log entries returned to callers: timestamp, level, component, message, and caller.
  • internal/logger/buffer.go:33-39 creates a global log buffer holding the last 10,000 entries.
  • internal/api/server.go:540-558 permits up to limit=1000 and since_minutes=1440 in one unauthenticated request.

Authentication is enabled by default and /api/v1/logs is not listed as a public route:

  • internal/config/config.go:841-843 defaults auth to enabled.
  • internal/auth/middleware.go:29-41 public defaults are /health, /ready, /api/v1/auth/verify, and /metrics prefix; /api/v1/logs is not public.

However, Fiber route/middleware order makes the later middleware ineffective for an earlier exact route. Local verification against Fiber v2.52.13 showed a route registered before app.Use(...) returns 200 and the later middleware is not reached. Fiber’s router walks routes in declaration order and stops after the first matching route unless the handler calls c.Next(); logsHandler does not call c.Next().

Proof of concept

Safe local reproduction only; do not scan external infrastructure.

  1. Start Arc with default authentication enabled.
  2. Request logs without an Authorization header or x-api-key header:
curl -i 'http://127.0.0.1:8000/api/v1/logs?limit=1000&since_minutes=1440'

Expected vulnerable result:

HTTP/1.1 200 OK
Content-Type: application/json

{"timestamp":"...","count":...,"logs":[...]}
  1. Compare with a protected endpoint without credentials:
curl -i 'http://127.0.0.1:8000/api/v1/auth/tokens'

Expected protected result:

HTTP/1.1 401 Unauthorized

This demonstrates that default auth is active while /api/v1/logs bypasses it due to registration order.

Impact

An unauthenticated network attacker can retrieve recent application logs. Depending on deployment and log level, logs can disclose operational metadata such as component names, internal paths, database/measurement names, node identifiers, caller locations, request outcomes, and error details. This can assist further attacks and may expose sensitive data if any deployment logs secrets or user-controlled confidential data.

The audit did not confirm that the bootstrap admin token banner is captured by this endpoint; that banner is printed with fmt.Fprintf(os.Stderr, ...), while this endpoint reads the zerolog-backed application buffer.

Workarounds

Until patched, operators can restrict access to /api/v1/logs at a reverse proxy, firewall, ingress policy, or service mesh. If the endpoint is not needed, block it entirely.

Suggested fix

  • Move /api/v1/logs registration after global auth middleware and require an authenticated administrator; or
  • Add explicit route-level middleware: auth.RequireAdmin(authManager) for /api/v1/logs; and
  • Add a regression test that unauthenticated requests to /api/v1/logs return 401/403 while /health and /ready remain public.

References / evidence

  • cmd/arc/main.go:1598-1618
  • internal/api/server.go:164-183
  • internal/api/server.go:537-567
  • internal/auth/middleware.go:29-41
  • internal/config/config.go:841-843
  • internal/logger/buffer.go:9-16
  • internal/logger/buffer.go:33-39
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/basekick-labs/arc"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.0.0-20260615165136-bb7d9761ad98"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-200",
      "CWE-306"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-11-03T16:29:38Z",
    "nvd_published_at": null,
    "severity": "LOW"
  },
  "details": "## Summary\n\nArc exposes `GET /api/v1/logs` without authentication even when authentication is enabled by default. The route is registered before the global Fiber authentication middleware, and the handler returns recent buffered application logs without performing its own authorization check.\n\n## Details\n\nArc applies the global auth middleware after calling `server.RegisterRoutes()`:\n\n- `cmd/arc/main.go:1598-1599` registers base routes via `server.RegisterRoutes()`.\n- `cmd/arc/main.go:1601-1618` configures and installs `auth.NewMiddleware(...)` later.\n\n`server.RegisterRoutes()` registers `GET /api/v1/logs` as a base route:\n\n- `internal/api/server.go:164-183` registers base health, metrics, and logs routes, including `s.app.Get(\"/api/v1/logs\", s.logsHandler)`.\n\nThe logs handler returns buffered logs without checking authentication or authorization:\n\n- `internal/api/server.go:537-567` parses `limit`, `level`, and `since_minutes`, reads `logger.GetBuffer().GetRecent(...)`, and returns JSON.\n- `internal/logger/buffer.go:9-16` defines log entries returned to callers: timestamp, level, component, message, and caller.\n- `internal/logger/buffer.go:33-39` creates a global log buffer holding the last 10,000 entries.\n- `internal/api/server.go:540-558` permits up to `limit=1000` and `since_minutes=1440` in one unauthenticated request.\n\nAuthentication is enabled by default and `/api/v1/logs` is not listed as a public route:\n\n- `internal/config/config.go:841-843` defaults auth to enabled.\n- `internal/auth/middleware.go:29-41` public defaults are `/health`, `/ready`, `/api/v1/auth/verify`, and `/metrics` prefix; `/api/v1/logs` is not public.\n\nHowever, Fiber route/middleware order makes the later middleware ineffective for an earlier exact route. Local verification against Fiber v2.52.13 showed a route registered before `app.Use(...)` returns `200` and the later middleware is not reached. Fiber\u2019s router walks routes in declaration order and stops after the first matching route unless the handler calls `c.Next()`; `logsHandler` does not call `c.Next()`.\n\n## Proof of concept\n\nSafe local reproduction only; do not scan external infrastructure.\n\n1. Start Arc with default authentication enabled.\n2. Request logs without an `Authorization` header or `x-api-key` header:\n\n```bash\ncurl -i \u0027http://127.0.0.1:8000/api/v1/logs?limit=1000\u0026since_minutes=1440\u0027\n```\n\nExpected vulnerable result:\n\n```http\nHTTP/1.1 200 OK\nContent-Type: application/json\n\n{\"timestamp\":\"...\",\"count\":...,\"logs\":[...]}\n```\n\n3. Compare with a protected endpoint without credentials:\n\n```bash\ncurl -i \u0027http://127.0.0.1:8000/api/v1/auth/tokens\u0027\n```\n\nExpected protected result:\n\n```http\nHTTP/1.1 401 Unauthorized\n```\n\nThis demonstrates that default auth is active while `/api/v1/logs` bypasses it due to registration order.\n\n## Impact\n\nAn unauthenticated network attacker can retrieve recent application logs. Depending on deployment and log level, logs can disclose operational metadata such as component names, internal paths, database/measurement names, node identifiers, caller locations, request outcomes, and error details. This can assist further attacks and may expose sensitive data if any deployment logs secrets or user-controlled confidential data.\n\nThe audit did not confirm that the bootstrap admin token banner is captured by this endpoint; that banner is printed with `fmt.Fprintf(os.Stderr, ...)`, while this endpoint reads the zerolog-backed application buffer.\n\n## Workarounds\n\nUntil patched, operators can restrict access to `/api/v1/logs` at a reverse proxy, firewall, ingress policy, or service mesh. If the endpoint is not needed, block it entirely.\n\n## Suggested fix\n\n- Move `/api/v1/logs` registration after global auth middleware and require an authenticated administrator; or\n- Add explicit route-level middleware: `auth.RequireAdmin(authManager)` for `/api/v1/logs`; and\n- Add a regression test that unauthenticated requests to `/api/v1/logs` return 401/403 while `/health` and `/ready` remain public.\n\n## References / evidence\n\n- `cmd/arc/main.go:1598-1618`\n- `internal/api/server.go:164-183`\n- `internal/api/server.go:537-567`\n- `internal/auth/middleware.go:29-41`\n- `internal/config/config.go:841-843`\n- `internal/logger/buffer.go:9-16`\n- `internal/logger/buffer.go:33-39`",
  "id": "GHSA-m3qr-fvp4-78xj",
  "modified": "2026-11-03T16:29:38Z",
  "published": "2026-11-03T16:29:38Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/Basekick-Labs/arc/security/advisories/GHSA-m3qr-fvp4-78xj"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Basekick-Labs/arc/pull/506"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Basekick-Labs/arc/commit/bb7d9761ad9801e93837762ff7d37460f1df19dd"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Basekick-Labs/arc"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Basekick-Labs/arc/releases/tag/v26.06.2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [],
  "summary": "Arc has unauthenticated application log disclosure via `/api/v1/logs`"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON
How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.