CVE-2026-47735 exposes a fundamental architectural failure in how Arc enforced data access controls at its DuckDB interface. The vulnerability wasn't a simple oversight — it was the predictable collision of two independent security boundaries that operated on incompatible mental models.
The first control was a regex denylist at the API boundary, blocking specific functions like read_parquet( and arc_partition_agg(. This approach solved a known-bad-instances problem as if it were a known-bad-classes problem. The denylist was inherently incomplete because DuckDB's extension model allows new I/O functions to be registered at runtime — you cannot enumerate a function family that grows dynamically. Every release of DuckDB potentially adds new attack surface that the denylist must manually track.
The second control was an RBAC layer that checked table references in FROM and JOIN clauses, assuming dangerous data access flows only through those paths. This assumption missed scalar table functions in SELECT expressions, which provide equally valid data access. The RBAC extractor and the regex validator were built by different people at different times with different threat models, and neither was designed with knowledge of the other.
The intersection of these blind spots meant any user who could submit SQL could read any file the process could reach — a complete failure of multi-tenant isolation, far worse than the CVSS 7.1 suggests.
The structural fix pushes file access restrictions down to the DuckDB execution layer, which is the correct approach. But this relocation is itself a confession: the original placement was architecturally wrong, not just incomplete. The question your team should ask is whether similar regex-at-the-boundary patterns exist elsewhere in your system — denylists for function families that can grow through plugins, extensions, or user-defined code.
One residual risk remains: already-loaded extensions remain callable after the lockdown takes effect. This isn't acceptable technical debt — it's the same failure mode the CVE describes, recreated by the fix itself. If an attacker achieves code execution before lockdown completes, or exploits a pre-existing extension, the sandbox model collapses. Audit any extensions loaded before the fix and verify they cannot register dangerous functions retroactively.