Bug 2521251 (CVE-2026-48050)

Summary:	CVE-2026-48050 net/http/pprof: github.com/basekick-labs/arc: Arc: Information disclosure and Denial of Service via unauthenticated debug endpoints
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability-draft	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	aazores, abarbaro, akhatavk, akostadi, akoudelk, alebedev, alizardo, amasferr, amctagga, anjoseph, anpicker, ansmith, anthomas, aoconnor, aos-team-art-private, aruklets, asdas, bniver, bparees, cmah, dakwon, dhanak, dkeler, dmayorov, doconnor, dpaolell, drosa, dsimansk, dymurray, eaguilar, ebaron, eborisov, eglynn, ehelms, flucifre, gbenhaim, ggainey, gmeno, gparvin, groman, hasun, ibolton, jbritton, jcantril, jchui, jdelft, jfula, jhe, jjoyce, jlledo, jmatsuok, jmatthew, jmontleo, jowilson, jpasqual, jprabhak, jpretori, jschluet, jtolenti, jupierce, juwatts, kingland, ktsao, lball, lbragsta, lchilton, lgamliel, lgarciaa, lhh, mbenjamin, mbiarnes, mburns, mdellweg, mgarciac, mhackett, mhulan, mnovotny, mwringe, nboldt, ngough, niyer, nmoumoul, nyancey, oaljalju, ometelka, osousa, pantinor, pcreech, pgaikwad, pjindal, ppalepu, ppostler, prdhamdh, psrna, ptisnovs, rchan, rekumar, rhaigner, rhel-process-autobot, rjohnson, rojacob, sakbas, sausingh, sbratsla, sdawley, sfeifer, sghai, sidsharm, slucidi, smallamp, sostapov, sseago, suppawar, syedriko, thason, tmalecek, tsedmik, twaugh, tzivkovi, vereddy, veshanka, vlaad, vvoronko, watson-tool-maintainers, wenshen, whayutin, wtam, xdharmai
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in Arc. This vulnerability allows a remote unauthenticated attacker to access Go debug pprof endpoints due to improper authentication bypass. Successful exploitation can lead to the disclosure of sensitive runtime state information and enable a CPU-burn Denial of Service (DoS) attack, impacting the availability and confidentiality of the system.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-08-21 22:51:28 UTC

Arc is an open, SQL-native time-series database for telemetry. Versions prior to 26.06.1 register Go's `net/http/pprof` handlers at `/debug/pprof/*` via `app.Use(pprof.New())` in `internal/api/server.go`, and `/debug/pprof` is added to `PublicPrefixes` in `cmd/arc/main.go`. The auth middleware short-circuits before the token check on prefix match, so the endpoints are reachable without any authentication. Version 26.06.1 contains a patch. Some workarounds are available. Block `/debug/pprof*` at a reverse proxy / load balancer in front of Arc, restrict Arc's API port to known-trusted networks via firewall rules, and/or patch the running build: comment out `app.Use(pprof.New())` in `internal/api/server.go` and rebuild.

Comment 1 Jon Orris 2026-09-16 17:19:58 UTC

This issue has been addressed in the following products:

  RHEM 1.2 for RHEL 10
  RHEM 1.2 for RHEL 9

Via RHSA-2026:68335 https://access.redhat.com/errata/RHSA-2026:68335

Comment 2 Jon Orris 2026-09-16 17:22:31 UTC

This issue has been addressed in the following products:

  RHEM 1.1 for RHEL 10
  RHEM 1.1 for RHEL 9

Via RHSA-2026:68334 https://access.redhat.com/errata/RHSA-2026:68334