CVE-2026-47735

Executive Summary

CVE-2026-47735 is an unauthenticated arbitrary file read vulnerability in Arc, an open-source SQL-native time-series database for telemetry, affecting all versions prior to 26.06.1. The flaw stems from an incomplete regex-based denylist in the user-SQL validator that fails to block DuckDB's broader I/O function family (read_csv, read_json, read_text, read_blob, glob, parquet_metadata, etc.), combined with a limited RBAC table-reference extraction that only inspects FROM/JOIN clauses. This enables a remote attacker to submit SQL queries via the public API that chain scalar table functions in the SELECT list to read arbitrary files from the host filesystem, potentially exfiltrating sensitive data such as credentials, configuration files, or telemetry data. The vendor has released version 26.06.1 containing a structural sandbox at the DuckDB layer; however, patch confidence is rated 0/4 from tracked sources, and no CISA KEV listing or public exploit code has been observed at this time.

Technical Analysis

The vulnerability resides in Arc's user-SQL validation layer, specifically in internal/api/query.go, within the ValidateSQLRequest function. This function applies a regex-based denylist intended to restrict dangerous DuckDB functions from being executed by end users. However, the denylist is incomplete: it blocks only two function patterns — read_parquet( and arc_partition_agg( — while leaving the broader DuckDB I/O function family exposed. The affected functions include read_csv_auto, read_csv, read_json, read_json_auto, read_text, read_blob, glob, parquet_metadata, parquet_schema, read_xlsx, and similar I/O capable functions.

The second layer of defense — RBAC table-reference extraction — is also flawed. It inspects only FROM and JOIN clauses when determining which database tables a user is permitted to access. This means that scalar table functions invoked in the SELECT list of a query are never checked against the RBAC permission model. By placing a table function such as read_csv('/etc/passwd') or read_blob('/var/lib/arc/credentials') inside the SELECT clause rather than the FROM clause, an attacker can bypass both the regex denylist (because the specific function was not blocked) and the RBAC reference extraction (because the reference is not in a FROM/JOIN clause).

At the vulnerability-class level, this is a path traversal / arbitrary file read vulnerability (CWE-22) manifested through insufficient input validation in a SQL query processing pipeline. The DuckDB underlying engine supports a rich set of table functions that interface directly with the operating system filesystem; when the application fails to sandbox or restrict these functions, the database becomes a vector for accessing host files. The fix in version 26.06.1 implements a structural sandbox at the DuckDB layer, which refuses to open any file outside an explicit allowlist, and additionally refuses further INSTALL and LOAD operations. Notably, already-loaded DuckDB extensions remain callable after the lockdown, which the vendor acknowledges as a limitation with some workarounds still available.

The attack surface is the public-facing SQL query API endpoint, which accepts arbitrary SQL from users. No authentication is required to reach the vulnerable code path if the API is exposed to the network. The severity is amplified by the fact that Arc is marketed as a telemetry database — often deployed in environments where the host filesystem contains sensitive infrastructure data (database credentials, TLS private keys, application secrets, configuration files). An attacker who successfully exploits this flaw can read these files without needing any prior access or privileges, making this a critical remote information disclosure vulnerability despite the absence of an official CVSS score.

Insufficient technical detail is available regarding the exact request format required to reach ValidateSQLRequest; however, the function name and file path are stated in the NVD description, and the capability to submit arbitrary SQL via API is implied by the described validator.

Exploitation Scenarios

Reconnaissance / Target Identification: An attacker begins by identifying exposed Arc instances. Shodan or similar search engines can be used with dorks such as title:"Arc" sql database telemetry to locate internet-facing Arc deployments. Alternatively, the attacker may probe a known application using Arc for telemetry storage (e.g., IoT gateways, observability platforms) and identify the SQL query API endpoint.

Triggering the Flaw Class: Once the API endpoint is discovered, the attacker submits a SQL query that:

1. Uses a DuckDB I/O function from the unblocked family (e.g., read_csv, read_json, glob) inside the SELECT clause, and
2. References a target file path on the host filesystem.

Because the regex denylist only matches read_parquet( and arc_partition_agg(, functions like read_csv_auto and read_blob are not blocked. Because the RBAC extraction only inspects FROM/JOIN clauses, the SELECT-list placement evades the permission check.

Payload / Execution Method (Class Level): For a generic DuckDB/I/O function bypass of this class, a working payload resembles:

SELECT * FROM read_csv('/etc/passwd');

However, this would place the function in the FROM clause and would be caught by RBAC extraction. The bypassed variant places the table function in the SELECT list via a subquery pattern:

SELECT (SELECT content FROM read_text('/etc/shadow')) AS leaked;

Or using a correlated scalar subquery:

SELECT read_text('/var/lib/arc/.env') AS secrets FROM (SELECT 1) AS t;

At the vulnerability-class level, this is an SQL injection into an unsandboxed DuckDB engine that permits filesystem interaction. No public PoC is available; the attack chain is inferred from the vulnerability class and the explicit description of the flawed validation layers.

Post-Exploitation Impact: Successful exploitation yields arbitrary file read as the operating-system user running the Arc process (typically a service account). The attacker can:

• Extract database connection strings and credentials from application config files.
• Read TLS/SSL private keys, enabling man-in-the-middle attacks or service impersonation.
• Access telemetry data that may include sensitive business information.
• Read /etc/shadow (if readable) for password hashes, or SSH keys for lateral movement.
• Harvest cloud provider credentials (e.g., AWS keys in ~/.aws/credentials).

Combined with other weaknesses, this server-side file disclosure could enable full system compromise. The data exfiltration can be performed over the same SQL API, making the entire attack remote, unauthenticated, and single-request.

Impact Assessment

Business Impact: Critical. The vulnerability allows a remote, unauthenticated attacker to read arbitrary files from the host server. This constitutes a complete breach of data confidentiality for the affected host. Depending on what the host filesystem contains, the impact could escalate to credential theft, lateral movement within the enterprise, and full infrastructure compromise.

Affected Systems: All Arc deployments running versions prior to 26.06.1. Any installation where the SQL API is exposed to untrusted networks (including the internet, partner networks, or semi-trusted internal networks) is at risk. Even internal deployments are vulnerable if any user can reach the API without strict network segmentation.

Blast Radius: The blast radius is directly proportional to the sensitivity of the host filesystem. In typical deployments:

• Telemetry databases reside on dedicated hosts with service accounts that may have broad read access to config files, log directories, and mounted volumes.
• Credentials for the telemetry data itself (e.g., Redis, PostgreSQL) could be exfiltrated.
• In containerized deployments, the host filesystem mount may expose secrets from orchestration platforms.

CVSS Rationale (Inferred): Although no official CVSS vector was provided, the characteristics map to: Network attack vector (AV:N), Low attack complexity (AC:L), No privileges required (PR:N), No user interaction (UI:N), Changed scope (S:C) since the impacted filesystem is outside the database security boundary, High confidentiality impact (C:H), No integrity impact (I:N), No availability impact (A:N). This yields a base score of approximately 10.0, reflecting the critical nature of unauthenticated remote arbitrary file read.

Known Exploitation: CISA KEV: NO. EPSS: Not yet scored. No public PoC or exploit code is currently available; exploitation of this class of vulnerability is well-documented, and weaponization is anticipated.

Detection Guidance

Detection of this vulnerability is challenging because the malicious SQL is submitted over the normal application API. The following rules focus on identifying anomalous file-path references in SQL queries, unauthorized access from unexpected IPs, and abnormal DuckDB function calls.

Sigma Rule

title: Arc SQL API - Suspicious DuckDB I/O Function in SELECT
id: b8f7e2c1-4a3d-4f6e-9a2b-5c8d1e0f3a7b
status: experimental
description: Detects SQL queries submitted to the Arc API containing DuckDB I/O filesystem functions in unusual positions (SELECT list), indicating a possible attempt to exploit CVE-2026-47735.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-47735
author: valtersit.com Threat Intelligence
date: 2025/06/13
logsource:
    category: application
    product: arc
    service: query_api
detection:
    selection_paths:
        - 'query': '*read_csv*'
        - 'query': '*read_json*'
        - 'query': '*read_text*'
        - 'query': '*read_blob*'
        - 'query': '*glob*'
        - 'query': '*parquet_metadata*'
        - 'query': '*parquet_schema*'
        - 'query': '*read_xlsx*'
    selection_sensitive_paths:
        - 'query': '*/etc/*'
        - 'query': '*/var/*'
        - 'query': '*/home/*'
        - 'query': '*/root/*'
        - 'query': '*/proc/*'
        - 'query': '*/sys/*'
        - 'query': '*.env'
        - 'query': '*.pem'
        - 'query': '*.key'
        - 'query': '*.json'
    condition: selection_paths and selection_sensitive_paths
    timeframe: 5m
level: high
falsepositives:
    - Legitimate read_csv/read_json usage by internal monitoring tools if such usage is sanctioned.
    - File reads via queries should be rare; baseline normal operations before tuning.
fields:
    - source_ip
    - user_agent
    - query
status_tags: CVE-2026-47735

YARA Rule

rule Detect_Arc_File_Read_Exploit_Payloads
{
    meta:
        author = "valtersit.com"
        description = "Detects strings commonly found in SQL payloads exploiting CVE-2026-47735 - DuckDB I/O functions reading host files"
        cve = "CVE-2026-47735"
        date = "2025-06-13"
        version = "1.0"

    strings:
        $csv = "read_csv" ascii nocase
        $csv_auto = "read_csv_auto" ascii nocase
        $json = "read_json" ascii nocase
        $text = "read_text" ascii nocase
        $blob = "read_blob" ascii nocase
        $glob = "glob(" ascii nocase
        $parquet_meta = "parquet_metadata" ascii nocase
        $parquet_schema = "parquet_schema" ascii nocase
        $xlsx = "read_xlsx" ascii nocase

        $path_etc = "/etc/" ascii
        $path_proc = "/proc/" ascii
        $path_var = "/var/" ascii
        $path_home = "/home/" ascii
        $path_root = "/root/" ascii
        $path_env = ".env" ascii
        $path_passwd = "passwd" ascii
        $path_shadow = "shadow" ascii
        $path_ssh = ".ssh" ascii

    condition:
        (1 of ($csv*)) and (1 of ($path*))
        or (1 of ($json*)) and (1 of ($path*))
        or (1 of ($text*)) and (1 of ($path*))
        or (1 of ($blob*)) and (1 of ($path*))
        or ($glob and 1 of ($path*))
        or (1 of ($parquet*)) and (1 of ($path*))
        or ($xlsx and 1 of ($path*))
}

Suricata IDS Rule

alert http any any -> any any (
    msg:"ET EXPLOIT Arc SQL API - DuckDB I/O Function with Host File Path (CVE-2026-47735)";
    flow:established,to_server;
    content:"read_csv"; http_client_body; nocase;
    content:"/etc/"; http_client_body; distance:0;
    reference:cve,2026-47735;
    classtype:attempted-admin;
    sid:2026477; rev:1;
)

Elastic Detection

sequence by source.ip with maxspan=5m
  [any where process.name == "arc" and event.action == "query" and
   query like "*read_csv*" or query like "*read_json*" or query like "*read_text*" or
   query like "*read_blob*" or query like "*glob*" or query like "*parquet_*"]
  [any where process.name == "arc" and event.action == "query" and
   (query like "*/etc/*" or query like "*/var/*" or query like "*/home/*" or
    query like "*/root/*" or query like "*.env" or query like "*.key" or query like "*.pem")]

Splunk SPL Query

sourcetype="arc:query:api" 
  ( query="*read_csv*" OR query="*read_json*" OR query="*read_text*" OR 
    query="*read_blob*" OR query="*glob(*" OR query="*parquet_metadata*" OR 
    query="*parquet_schema*" OR query="*read_xlsx*" ) 
  AND 
  ( query="*/etc/*" OR query="*/var/*" OR query="*/home/*" OR query="*/root/*" OR 
    query="*/proc/*" OR query="*.env" OR query="*.pem" OR query="*.key" )
| stats count by src_ip, user, query, _time
| sort - _time

Wazuh OSSEC Rule

<group name="arc,">
  <rule id="100477" level="12">
    <decoded_as>json</decoded_as>
    <field name="query">\.read_csv|read_json|read_text|read_blob|glob|parquet_metadata|parquet_schema|read_xlsx</field>
    <field name="query">\./etc/|/var/|/home/|/root/|/proc/|\.env|\.pem|\.key|passwd|shadow</field>
    <description>Arc: Potential CVE-2026-47735 exploitation - DuckDB I/O function with host file path in SQL query</description>
    <group>cve-2026-47735,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
    <options>no_full_log</options>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The vendor has released version 26.06.1 per the NVD description, but no patch verification from independent sources is available.

Immediate Mitigations (to be applied immediately while awaiting verified patch):

1. Restrict API network access: Configure firewall rules to permit only known-trusted networks and IP ranges to reach the Arc SQL API. If the API is internet-facing, block it entirely or place it behind a VPN/reverse proxy with strong authentication.
2. Temporary denylist expansion: Add the additional DuckDB I/O functions (read_csv*, read_json*, glob, read_text, read_blob, parquet_metadata, parquet_schema, read_xlsx, etc.) to the dangerousSQLPattern array in internal/api/query.go. This is explicitly suggested in the NVD description as a temporary mitigation. Note: this is a stopgap and may be bypassed if the validation logic is reordered or if new functions are added in future DuckDB upgrades.
3. Disable or restrict DuckDB extensions: If possible, prevent loading of filesystem-accessing DuckDB extensions. Monitor for INSTALL or LOAD queries and block them.
4. Run Arc with a least-privilege OS account: Ensure the Arc process runs as a dedicated non-privileged user with minimal read access to the filesystem. Restrict read permissions on sensitive files such as /etc/shadow, application secrets, and TLS private keys.

Patch/Upgrade Steps:

1. Wait for vendor release of verified version 26.06.1. Confirm the patch via release notes on the official Arc repository. Do not rely solely on the NVD description; verify the build artifact's integrity.
2. Upgrade to version 26.06.1 or later once available. The structural sandbox at the DuckDB layer is the definitive fix — ensure the upgradeprocess validates that the sandbox is active and that only allowlisted files can be opened.
3. After upgrade, run penetration tests to confirm that read_csv/read_json/read_blob etc. are no longer accessible from untrusted SQL.

Long-Term Hardening:

1. Network architecture: Host Arc on internal networks only; do not expose telemetry databases to the internet. Use API gateways with authentication and rate limiting.
2. Defense-in-depth for SQL APIs: Implement a robust SQL allowlist/parser approach rather than denylists. Consider using a structured query parser that extracts ALL function references (not just FROM/JOIN) and validates them against an allowlist of permitted functions.
3. Filesystem hardening: Apply mandatory access control (SELinux/AppArmor) to confine the Arc process to its required directories. Use filesystem encryption and restricted permissions on sensitive files.
4. Monitoring: Deploy the detection rules above in your SIEM/EDR to catch both exploit attempts and post-exploitation file-read behavior.
5. Dependency management: Track DuckDB version updates and review DuckDB release notes for new table functions that may introduce fresh I/O capabilities. Re-audit the validation layer after each DuckDB upgrade.
6. Regular security audits: Conduct periodic code audits of any custom application that sits between the network and duckdb-like engines, with specific attention to input validation completeness.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-47735
2. Vendor Repository (inferred): arc-db/arc (official GitHub) — check for release notes for version 26.06.1 and security advisory.
3. DuckDB Documentation (for I/O function reference): https://duckdb.org/docs/stable/data/overview — documents read_csv, read_json, read_blob, glob, etc., used to understand the exposed function family.
4. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — current listing: NO (as of report date).
5. MITRE ATT&CK Technique T1190: https://attack.mitre.org/techniques/T1190/ — Exploit Public-Facing Application, applicable to this CVE class.

Threat Actor Activity: No known threat actor campaigns or in-the-wild exploitation have been publicly documented for CVE-2026-47735 at the time of this report. Given the high value of telemetry database hosts and the low exploitation complexity, actively monitor for emerging threat intelligence and add this CVE to your vulnerability-scanning pipelines.