A critical authentication bypass and resource exhaustion vulnerability in the Basekick-Labs arc database could allow unauthenticated attackers to access sensitive telemetry data and cause denial-of-service.

The software fails to implement proper authentication for critical functions (CWE-306), leading to the exposure of sensitive information (CWE-200) and vulnerability to uncontrolled resource consumption (CWE-400). This vulnerability is exploitable by an unauthenticated attacker over the network.

The impact of this vulnerability is high, as it allows unauthorized actors to extract telemetry data and consume system resources, potentially leading to a denial-of-service condition. A CVSS score of 8.8 highlights the severity of allowing unauthenticated access to a data-centric application, which could result in significant operational disruption and data leakage.

Immediate Action: Upgrade the arc database to version 26.06.1 or later to implement the necessary authentication controls.

Proactive Monitoring: Review system access logs for unauthorized connection attempts and monitor CPU or memory usage patterns that deviate from established baselines.

Compensating Controls: Isolate the database within a private network segment and restrict access via firewall rules to known, authorized IP addresses only.

Public Exploit Available: No (exploit_available: false)

Given the critical nature of the exposed functions, immediate patching to version 26.06.1 is essential. Organizations should prioritize isolating this service until the update is applied to prevent unauthorized access to sensitive telemetry.