8.8

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-48050

CVE-2026-48050: Arc: Unauthenticated access to Go debug pprof endpoints leaks runtime state and enables CPU-burn DoS

Summary

Arc registers Go's net/http/pprof handlers at /debug/pprof/* via app.Use(pprof.New()) in internal/api/server.go, and /debug/pprof is added to PublicPrefixes in cmd/arc/main.go. The auth middleware short-circuits before the token check on prefix match, so the endpoints are reachable without any authentication.

Impact

Any network-reachable caller (no token required) can:

Fetch /debug/pprof/heap — leaks in-memory state: live SQL strings, decoded msgpack records, decompressed request bodies, cached *TokenInfo (the auth cache keys on SHA-256 of the plaintext token at auth.go:543).
Fetch /debug/pprof/goroutine?debug=2 — leaks call stacks, identifying internal code paths.
Fetch /debug/pprof/profile?seconds=N — pins a CPU core for arbitrary duration. Trivial DoS amplification (one short HTTP request → minutes of server CPU).
Fetch /debug/pprof/trace — long-duration execution trace, similar DoS profile.

No authentication, no rate limiting, no resource bound on the seconds parameter.

Patches

https://github.com/Basekick-Labs/arc/releases/tag/v26.06.1

Planned mitigation:

Gate pprof registration behind an env var (ARC_DEBUG_PPROF=1) that defaults to off.
When enabled, bind pprof to a separate localhost-only listener (127.0.0.1:6060 via dedicated net/http server) so it's never reachable from the public API port.
Remove /debug/pprof from PublicPrefixes.
Fix the HasPrefix bug where "/debug/pprofX" matches "/debug/pprof".

Workarounds

Miggo Vulnerability Database

→

CVE-2026-48050

CVE-2026-48050:

8.8

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/basekick-labs/arc	go	< 0.0.0-20260520170331-32a4091fb949	0.0.0-20260520170331-32a4091fb949

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability was caused by the unconditional registration of Go's net/http/pprof debugging endpoints on the main, public-facing API server. This was done in the api.NewServer function. Compounding this, the main.main function explicitly configured the authentication middleware to treat /debug/pprof as a public, unauthenticated prefix. This allowed any network-reachable user to access sensitive debugging information and trigger performance-intensive profiling, leading to information disclosure and denial-of-service.

A secondary, defense-in-depth flaw existed in the auth.NewMiddleware function, which used a weak prefix matching logic (strings.HasPrefix). This would have allowed an attacker to bypass authentication for any path that shared a prefix with a legitimate public route.

The patch addresses these issues comprehensively. It removes the pprof middleware from the public server entirely. Instead, it introduces a new, opt-in mechanism (startDebugPprofIfEnabled) in cmd/arc/main.go that, when enabled via an environment variable, runs the pprof server on a separate, localhost-only port, isolating it from the public API. Additionally, the prefix matching in auth.NewMiddleware was hardened to prevent similar bypass vulnerabilities in the future. During exploitation, a runtime profiler would have shown calls to functions within the net/http/pprof package, such as pprof.Profile (for DoS) or pprof.Index (for information leakage), originating from unauthenticated HTTP requests.

Vulnerable functions

api.NewServer

internal/api/server.go

This function was responsible for setting up the main web application. It unconditionally registered the `pprof` middleware, which exposed sensitive debugging endpoints to the public. The patch removes this registration, making it a key part of the vulnerability.

main.main

cmd/arc/main.go

The main function configured the authentication middleware to treat `/debug/pprof` as a public path, effectively disabling authentication for all of its sub-paths. This configuration allowed unauthenticated access to the pprof endpoints.

auth.NewMiddleware

internal/auth/middleware.go

This function creates the authentication middleware. The original implementation used a weak `strings.HasPrefix` check to identify public routes. This allowed an attacker to bypass authentication for any path that started with a public prefix (e.g., `/debug/pprof-anything`). The patch fixes this by implementing a stricter, anchored prefix match and path normalization.

net/http/pprof.Profile

net/http/pprof/pprof.go

While this function is from the Go standard library and not directly part of the Arc codebase, it is the function that would be executed during a CPU-based Denial-of-Service attack. An unauthenticated attacker could trigger this function via the `/debug/pprof/profile` endpoint, causing high CPU usage for an arbitrary duration. This function would be a primary indicator in a runtime profile during such an attack.

net/http/pprof.Index

net/http/pprof/pprof.go

Similar to `pprof.Profile`, this Go standard library function is the handler for endpoints like `/debug/pprof/heap` and `/debug/pprof/goroutine`. It was exposed without authentication, allowing attackers to leak sensitive runtime information, such as memory contents and goroutine stacks. This function would appear in a profiler's stack trace when the information leakage aspect of the vulnerability is exploited.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.