High [CVE-2026-48050] Information disclosure and Denial of Service via unauthenticated debug endpoints
This high-severity Red Hat Linux advisory covers CVE-2026-48050 affecting AWS Load Balancer Operator, cert-manager Operator for Red Hat OpenShift, Compliance Operator.
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
Arc is an open, SQL-native time-series database for telemetry. Versions prior to 26.06.1 register Go's `net/http/pprof` handlers at `/debug/pprof/*` via `app.
Use(pprof. New())` in `internal/api/server.go`, and `/debug/pprof` is added to `PublicPrefixes` in `cmd/arc/main.go`.
The auth middleware short-circuits before the token check on prefix match, so the endpoints are reachable without any authentication. Version 26.06.1 contains a patch.
Some workarounds are available. Block `/debug/pprof*` at a reverse proxy / load balancer in front of Arc, restrict Arc's API port to known-trusted networks via firewall rules, and/or patch the running build: comment out `app.
A flaw was found in Arc. This vulnerability allows a remote unauthenticated attacker to access Go debug pprof endpoints due to improper authentication bypass.
Successful exploitation can lead to the disclosure of sensitive runtime state information and enable a CPU-burn Denial of Service (DoS) attack, impacting the availability and confidentiality of the system. Red Hat severity: Important — CVSS 8.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H).
Weakness: CWE-306.
Affected products named by the advisory: AWS Load Balancer Operator; cert-manager Operator for Red Hat OpenShift; Compliance Operator; Confidential Compute Attestation; and 41 more.
- < 26.06.1
Official advisory · high-confidence parse· fetched 1 hour ago·verify at source
Mitigation
Upgrade to a fixed release: 26.06.1. That is the remediation for this advisory.
The vendor advisory may list additional interim mitigations or workarounds not captured here — review it before change work.
Official advisory · high-confidence parse· fetched 1 hour ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.