Arc allows unauthenticated access to the Go debug profiler endpoints /debug/pprof/* because the authorization middleware short‑circuits before the token check. The exposed endpoints leak internal runtime information and provide an attacker with the ability to trigger CPU‑burning operations, resulting in a denial of service. The weakness is reflected in CWE-200 (Information Disclosure), CWE-306 (Authorization Bypass), and CWE-400 (Uncontrolled Resource Consumption).

The vulnerability affects Basekick-Labs Arc, a SQL‑native time‑series database for telemetry. Versions released prior to 26.06.1 contain the flaw, while the 26.06.1 release and later versions include the patch that removes the pprof registration from the public API.

The CVSS score of 8.8 classifies this as a high‑severity vulnerability. EPSS is not available, and the issue is not listed in CISA KEV, but the absence of authentication makes the attack straightforward for any network actor with access to the Arc API port. The attacker can send simple HTTP requests to /debug/pprof and initiate CPU‑intensive profiling, exhausting resources and causing service disruption.