KEVWire

Security intelligence, with context.

Response snapshot Nov 3, 2026, 19:21 UTC

Back to the wire
Permalink
VulnerabilityGHSA-m3qr-fvp4-78xj

Arc has unauthenticated application log disclosure via `/api/v1/logs`

Arc exposes GET /api/v1/logs without authentication even when authentication is enabled by default. The route is registered before the global Fiber authentication middleware, and the handler returns recent buffered application logs without performing its own authorization check.

Published Updated

At a glance

Exploited
Not known
Severity
Not scored yet
Chance of exploitation
Not estimated
Sources
1 source

What to do

GitHub lists first patched versions: github.com/basekick-labs/arc: 0.0.0-20260615165136-bb7d9761ad98. Confirm the affected range and upgrade guidance in the exact advisory.

Read GitHub-reviewed advisory GHSA-m3qr-fvp4-78xj (opens a new tab)

What happened

Summary

Arc exposes GET /api/v1/logs without authentication even when authentication is enabled by default. The route is registered before the global Fiber authentication middleware, and the handler returns recent buffered application logs without performing its own authorization check.

Details

Arc applies the global auth middleware after calling server.RegisterRoutes():

Continue reading

- cmd/arc/main.go:1598-1599 registers base routes via server.RegisterRoutes(). - cmd/arc/main.go:1601-1618 configures and installs auth.NewMiddleware(...) later.

server.RegisterRoutes() registers GET /api/v1/logs as a base route:

- internal/api/server.go:164-183 registers base health, metrics, and logs routes, including s.app.Get("/api/v1/logs", s.logsHandler).

The logs handler returns buffered logs without checking authentication or authorization:

- internal/api/server.go:537-567 parses limit, level, and since_minutes, reads logger.GetBuffer().GetRecent(...), and returns JSON. - internal/logger/buffer.go:9-16 defines log entries returned to callers: timestamp, level, component, message, and caller. - internal/logger/buffer.go:33-39 creates a global log buffer holding the last 10,000 entries. - internal/api/server.go:540-558 permits up to limit=1000 and since_minutes=1440 in one unauthenticated request.

Authentication is enabled by default and /api/v1/logs is not listed as a public route:

- internal/config/config.go:841-843 defaults auth to enabled. - internal/auth/middleware.go:29-41 public defaults are /health, /ready, /api/v1/auth/verify, and /metrics prefix; /api/v1/logs is not public.

However, Fiber route/middleware order makes the later middleware ineffective for an earlier exact route. Local verification against Fiber v2.52.13 showed a route registered before app.Use(...) returns 200 and the later middleware is not reached. Fiber’s router walks routes in declaration order and stops after the first matching route unless the handler calls c.Next(); logsHandler does not call c.Next().

Proof of concept

Safe local reproduction only; do not scan external infrastructure.

1. Start Arc with default authentication enabled. 2. Request logs without an Authorization header or x-api-key header:

curl -i 'http://127.0.0.1:8000/api/v1/logs?limit=1000&since_minutes=1440'

Expected vulnerable result:

HTTP/1.1 200 OK
Content-Type: application/json

{"timestamp":"...","count":...,"logs":[...]}

3. Compare with a protected endpoint without credentials:

curl -i 'http://127.0.0.1:8000/api/v1/auth/tokens'

Expected protected result:

HTTP/1.1 401 Unauthorized

This demonstrates that default auth is active while /api/v1/logs bypasses it due to registration order.

Impact

An unauthenticated network attacker can retrieve recent application logs. Depending on deployment and log level, logs can disclose operational metadata such as component names, internal paths, database/measurement names, node identifiers, caller locations, request outcomes, and error details. This can assist further attacks and may expose sensitive data if any deployment logs secrets or user-controlled confidential data.

The audit did not confirm that the bootstrap admin token banner is captured by this endpoint; that banner is printed with fmt.Fprintf(os.Stderr, ...), while this endpoint reads the zerolog-backed application buffer.

Workarounds

Until patched, operators can restrict access to /api/v1/logs at a reverse proxy, firewall, ingress policy, or service mesh. If the endpoint is not needed, block it entirely.

Suggested fix

- Move /api/v1/logs registration after global auth middleware and require an authenticated administrator; or - Add explicit route-level middleware: auth.RequireAdmin(authManager) for /api/v1/logs; and - Add a regression test that unauthenticated requests to /api/v1/logs return 401/403 while /health and /ready remain public.

References / evidence

- cmd/arc/main.go:1598-1618 - internal/api/server.go:164-183 - internal/api/server.go:537-567 - internal/auth/middleware.go:29-41 - internal/config/config.go:841-843 - internal/logger/buffer.go:9-16 - internal/logger/buffer.go:33-39

Affected package ranges reported by GitHub: github.com/basekick-labs/arc: < 0.0.0-20260615165136-bb7d9761ad98

Related technology

Follow Go modules: RSS feedAll its recordsAsk your AI assistant

Sources

  1. Primary source

    GitHub-reviewed advisory GHSA-m3qr-fvp4-78xj (opens a new tab)

    The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review.

    Published Checked

  2. Primary source

    GitHub public advisory API page (opens a new tab)

    The API page supplied GHSA-m3qr-fvp4-78xj, its actual identifiers, source dates, and structured metrics.

    Published Date not suppliedChecked

Cite this record

For factual claims, cite the primary sources above; cite KEVWire for its compilation, dates, and classifications.

APA

KEVWire. (2026, November 3). Arc has unauthenticated application log disclosure via `/api/v1/logs`. https://kevwire.com/record/GHSA-m3qr-fvp4-78xj

MLA

"Arc has unauthenticated application log disclosure via `/api/v1/logs`." KEVWire, 3 Nov. 2026, kevwire.com/record/GHSA-m3qr-fvp4-78xj.

Chicago

KEVWire. "Arc has unauthenticated application log disclosure via `/api/v1/logs`." Last modified November 3, 2026. https://kevwire.com/record/GHSA-m3qr-fvp4-78xj.

Evidence summary (plain text)

Arc has unauthenticated application log disclosure via `/api/v1/logs` (Nov 3, 2026).
Arc exposes GET /api/v1/logs without authentication even when authentication is enabled by default. The route is registered before the global Fiber authentication middleware, and the handler returns recent buffered application logs without performing its own authorization check.

Arc applies the global auth middleware after calling server.RegisterRoutes():

- cmd/arc/main.go:1598-1599 registers base routes via server.RegisterRoutes().
- cmd/arc/main.go:1601-1618 configures and installs auth.NewMiddleware(...) later.
Sources:
GitHub-reviewed advisory GHSA-m3qr-fvp4-78xj: https://github.com/advisories/GHSA-m3qr-fvp4-78xj
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
Record ID: GHSA-m3qr-fvp4-78xj.
Record origin: Ingested record.
AI evidence: Not assessed.
Known exploitation: Not assessed.
Zero-day status: Not assessed. KEV membership alone does not establish zero-day status.
About this data

This record was ingested from a data source. Retrieved: Nov 3, 2026, 19:00 UTC. Ingestion is not an independent editorial investigation.

A CISA KEV listing documents known exploitation, not necessarily a zero-day; absence from the catalog does not prove a vulnerability has never been exploited.

Technology tags indicate possible relevance, not verified exposure. Confirm the affected product, version, and configuration against your own inventory; KEVWire does not scan your systems.

A personal reading checklist on this device, not verified remediation.

Record JSON

Your account

Email alerts

Email alerts are coming as part of KEVWire Premium: join the waitlist. To follow your stack today, use its RSS feed, which honors your filters, or connect an AI agent through the API.

Suggest an improvement

Ideas, missing sources, corrections, and bugs are all welcome. No account needed. Suggestions are reviewed by a person before anything changes.

Record details

Record detail