How should we interpret CVSS severity scores?

CVSS estimates technical severity, but it does not automatically equal business risk. Prioritize using context like internet exposure, asset criticality, known exploitation, and whether compensating controls exist. A Medium CVSS on an exposed production system can be more urgent than a Critical on an isolated non-production host.

Vulnerability Database

Q: What is a Vulnerability (CVE) and why does it matter?

A security vulnerability is a weakness in software, hardware, or configuration that can be exploited to compromise confidentiality, integrity, or availability. Many vulnerabilities are tracked as CVEs (Common Vulnerabilities and Exposures), which provide a standardized identifier so teams can coordinate patching, mitigation, and risk assessment across tools and vendors.

Q: What's the difference between a vulnerability, an exploit, and a zero-day?

A vulnerability is the underlying weakness. An exploit is the method or code used to take advantage of it. A zero-day is a vulnerability that is unknown to the vendor or has no publicly available fix when attackers begin using it. Risk increases sharply when exploitation becomes reliable or widespread.

Q: Why do vulnerabilities keep reappearing in our environment?

Recurring findings usually come from incomplete asset discovery, inconsistent patch management, inherited images, and configuration drift. In modern environments, you also need to watch the software supply chain: dependencies, containers, build pipelines, and third-party services can reintroduce the same weakness even after you patch a single host.

Q: How do we prioritize remediation without burning out the team?

Use a repeatable triage model: focus first on externally exposed assets, high-value systems (identity, VPN, email, production), vulnerabilities with known exploits, and issues that enable remote code execution or privilege escalation. Then enforce patch SLAs and track progress so remediation is steady, not reactive.

Q: How can SynScan help reduce vulnerability risk over time?

SynScan combines attack surface monitoring and continuous security auditing to keep your inventory current, flag high-impact vulnerabilities early, and help you turn raw findings into a practical remediation plan.

413,619

Total vulnerabilities in the database

Arc has unauthenticated application log disclosure via `/api/v1/logs` — github.com/basekick-labs/arc

Exposure of Sensitive Information to an Unauthorized Actor

Summary

Arc exposes GET /api/v1/logs without authentication even when authentication is enabled by default. The route is registered before the global Fiber authentication middleware, and the handler returns recent buffered application logs without performing its own authorization check.

Details

Arc applies the global auth middleware after calling server.RegisterRoutes():

cmd/arc/main.go:1598-1599 registers base routes via server.RegisterRoutes().
cmd/arc/main.go:1601-1618 configures and installs auth.NewMiddleware(...) later.

server.RegisterRoutes() registers GET /api/v1/logs as a base route:

internal/api/server.go:164-183 registers base health, metrics, and logs routes, including s.app.Get("/api/v1/logs", s.logsHandler).

The logs handler returns buffered logs without checking authentication or authorization:

internal/api/server.go:537-567 parses limit, level, and since_minutes, reads logger.GetBuffer().GetRecent(...), and returns JSON.
internal/logger/buffer.go:9-16 defines log entries returned to callers: timestamp, level, component, message, and caller.
internal/logger/buffer.go:33-39 creates a global log buffer holding the last 10,000 entries.
internal/api/server.go:540-558 permits up to limit=1000 and since_minutes=1440 in one unauthenticated request.

Authentication is enabled by default and /api/v1/logs is not listed as a public route:

internal/config/config.go:841-843 defaults auth to enabled.
internal/auth/middleware.go:29-41 public defaults are /health, /ready, /api/v1/auth/verify, and /metrics prefix; /api/v1/logs is not public.

However, Fiber route/middleware order makes the later middleware ineffective for an earlier exact route. Local verification against Fiber v2.52.13 showed a route registered before app.Use(...) returns 200 and the later middleware is not reached. Fiber’s router walks routes in declaration order and stops after the first matching route unless the handler calls c.Next(); logsHandler does not call c.Next().

Proof of concept

Safe local reproduction only; do not scan external infrastructure.

Start Arc with default authentication enabled.
Request logs without an Authorization header or x-api-key header:

curl -i &#039;http://127.0.0.1:8000/api/v1/logs?limit=1000&amp;since_minutes=1440&#039;

Expected vulnerable result:

HTTP/1.1 200 OK
Content-Type: application/json

{&quot;timestamp&quot;:&quot;...&quot;,&quot;count&quot;:...,&quot;logs&quot;:[...]}

Compare with a protected endpoint without credentials:

curl -i &#039;http://127.0.0.1:8000/api/v1/auth/tokens&#039;

Expected protected result:

HTTP/1.1 401 Unauthorized

This demonstrates that default auth is active while /api/v1/logs bypasses it due to registration order.

Impact

An unauthenticated network attacker can retrieve recent application logs. Depending on deployment and log level, logs can disclose operational metadata such as component names, internal paths, database/measurement names, node identifiers, caller locations, request outcomes, and error details. This can assist further attacks and may expose sensitive data if any deployment logs secrets or user-controlled confidential data.

The audit did not confirm that the bootstrap admin token banner is captured by this endpoint; that banner is printed with fmt.Fprintf(os.Stderr, ...), while this endpoint reads the zerolog-backed application buffer.

Workarounds

Until patched, operators can restrict access to /api/v1/logs at a reverse proxy, firewall, ingress policy, or service mesh. If the endpoint is not needed, block it entirely.

Suggested fix

Move /api/v1/logs registration after global auth middleware and require an authenticated administrator; or
Add explicit route-level middleware: auth.RequireAdmin(authManager) for /api/v1/logs; and
Add a regression test that unauthenticated requests to /api/v1/logs return 401/403 while /health and /ready remain public.

References / evidence

cmd/arc/main.go:1598-1618
internal/api/server.go:164-183
internal/api/server.go:537-567
internal/auth/middleware.go:29-41
internal/config/config.go:841-843
internal/logger/buffer.go:9-16
internal/logger/buffer.go:33-39

Published: Nov 3, 2026
Updated: Nov 4, 2026
GHSA: GHSA-m3qr-fvp4-78xj
Severity: Low
Exploit:
CISA KEV:

No technical information available.

CWEs:

Affected Software
References

Software	Affected versions
github.com/basekick-labs/arc	`< 0.0.0-20260615165136-bb7d9761ad98`

Is arc exposed on your perimeter?

A vulnerability database tells you what is broken. Attack surface management tells you where it is running: it discovers your internet-facing assets and flags the ones affected by issues like this one.

What is attack surface management? →

Deep Security Visibility Without the Complexity

SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.

No setup fees
5-min deployment
Cancel anytime

Book a Demo

Frequently Asked Questions

What is a Vulnerability (CVE) and why does it matter?

A security vulnerability is a weakness in software, hardware, or configuration that can be exploited to compromise confidentiality, integrity, or availability. Many vulnerabilities are tracked as CVEs (Common Vulnerabilities and Exposures), which provide a standardized identifier so teams can coordinate patching, mitigation, and risk assessment across tools and vendors.

CVSS (Common Vulnerability Scoring System) estimates technical severity, but it doesn't automatically equal business risk. Prioritize using context like internet exposure, affected asset criticality, known exploitation (proof-of-concept or in-the-wild), and whether compensating controls exist. A "Medium" CVSS on an exposed, production system can be more urgent than a "Critical" on an isolated, non-production host.

A vulnerability is the underlying weakness. An exploit is the method or code used to take advantage of it. A zero-day is a vulnerability that is unknown to the vendor or has no publicly available fix when attackers begin using it. In practice, risk increases sharply when exploitation becomes reliable or widespread.

Recurring findings usually come from incomplete Asset Discovery, inconsistent patch management, inherited images, and configuration drift. In modern environments, you also need to watch the software supply chain: dependencies, containers, build pipelines, and third-party services can reintroduce the same weakness even after you patch a single host. Unknown or unmanaged assets (often called Shadow IT) are a common reason the same issues resurface.

Use a simple, repeatable triage model: focus first on externally exposed assets, high-value systems (identity, VPN, email, production), vulnerabilities with known exploits, and issues that enable remote code execution or privilege escalation. Then enforce patch SLAs and track progress using consistent metrics so remediation is steady, not reactive.

SynScan combines attack surface monitoring and continuous security auditing to keep your inventory current, flag high-impact vulnerabilities early, and help you turn raw findings into a practical remediation plan.