Arc has unauthenticated application log disclosure via /api/v1/logs

Authentication is enabled by default and /api/v1/logs is not listed as a public route:

• ■internal/config/config.go:841-843 defaults auth to enabled.
• ■internal/auth/middleware.go:29-41 public defaults are /health, /ready, /api/v1/auth/verify, and /metrics prefix; /api/v1/logs is not public.

However, Fiber route/middleware order makes the later middleware ineffective for an earlier exact route. Local verification against Fiber v2.52.13 showed a route registered before app.Use(...) returns 200 and the later middleware is not reached. Fiber’s router walks routes in declaration order and stops after the first matching route unless the handler calls c.Next(); logsHandler does not call c.Next().

Proof of concept

Safe local reproduction only; do not scan external infrastructure.

1. 1.Start Arc with default authentication enabled.
2. 2.Request logs without an Authorization header or x-api-key header:

curl -i 'http://127.0.0.1:8000/api/v1/logs?limit=1000&since_minutes=1440'

Expected vulnerable result:

HTTP/1.1 200 OK
Content-Type: application/json

{"timestamp":"...","count":...,"logs":[...]}

1. 1.Compare with a protected endpoint without credentials:

curl -i 'http://127.0.0.1:8000/api/v1/auth/tokens'

Expected protected result:

HTTP/1.1 401 Unauthorized

This demonstrates that default auth is active while /api/v1/logs bypasses it due to registration order.

Impact

An unauthenticated network attacker can retrieve recent application logs. Depending on deployment and log level, logs can disclose operational metadata such as component names, internal paths, database/measurement names, node identifiers, caller locations, request outcomes, and error details. This can assist further attacks and may expose sensitive data if any deployment logs secrets or user-controlled confidential data.

The audit did not confirm that the bootstrap admin token banner is captured by this endpoint; that banner is printed with fmt.Fprintf(os.Stderr, ...), while this endpoint reads the zerolog-backed application buffer.

Workarounds

Until patched, operators can restrict access to /api/v1/logs at a reverse proxy, firewall, ingress policy, or service mesh. If the endpoint is not needed, block it entirely.

Suggested fix

• ■Move /api/v1/logs registration after global auth middleware and require an authenticated administrator; or
• ■Add explicit route-level middleware: auth.RequireAdmin(authManager) for /api/v1/logs; and
• ■Add a regression test that unauthenticated requests to /api/v1/logs return 401/403 while /health and /ready remain public.

References / evidence

• ■cmd/arc/main.go:1598-1618
• ■internal/api/server.go:164-183
• ■internal/api/server.go:537-567
• ■internal/auth/middleware.go:29-41
• ■internal/config/config.go:841-843
• ■internal/logger/buffer.go:9-16
• ■internal/logger/buffer.go:33-39

History