Arc: DuckDB I/O aliases bypass database RBAC after CVE-2026-47735

Arc is an open, SQL-native time-series database for telemetry. Prior to the repository-verified 26.06.2 repair, the remediation of CVE-2026-47735 leaves a cross-database authorization bypass through DuckDB table-valued I/O functions. In internal/database/sandbox.go, allowed_directories uses cfg.LocalStorageRoot, configured by storage.local_path, while enable_external_access=false blocks access outside that entire multi-tenant root. GetStoragePath in internal/storage/util.go stores all databases beneath it. In internal/api/query.go, extractTableReferences skips names followed by an opening parenthesis and checkQueryPermissions allows queries with no extracted table references, including tokens with permissions: []. The userSQLReadParquetPattern denylist catches literal read_parquet( and the earlier protection also blocks arc_partition_agg(, but misses the parquet_scan alias and glob, parquet_metadata, parquet_schema, read_blob, read_csv_auto, read_json and read_text. A request to POST /api/v1/query using these unblocked functions passes ValidateSQLRequest and convertSQLToStoragePaths without tenant authorization, allowing reads and enumeration of other databases' time-series data, schema and per-column value-range statistics within the allowlisted root. The sandbox still blocks out-of-root OS files and HTTP SSRF, and the sibling SQLite token database outside the root is not exposed by this mechanism. The earlier 26.06.1 remediation does not comprehensively deny these I/O functions. Repository tag 26.06.2 contains the I/O-function repair and supplies the provisional remediation boundary; conflicting advisory affected-version statements require curator adjudication.