Executive brief
Arc Enterprise is a time-series database used for telemetry that supports clustering across multiple nodes. The vulnerability allows an attacker with cluster credentials or who compromises a single node to register arbitrary file paths, enabling them to inject malicious data or read sensitive files across the entire cluster. Once exploited on one node, the malicious paths replicate automatically to all cluster peers, creating a widespread data compromise.
Technical details
The vulnerability is a path-traversal and insufficient input validation flaw in Arc Enterprise's Raft FSM (`internal/cluster/raft/fsm.go:applyRegisterFile`). The function accepts attacker-controlled file paths in manifest-registration Raft proposals with only a check that the path is non-empty; there is no rejection of parent-traversal sequences (`..`), no allowlist enforcement against the configured storage backend root, no scheme restriction (local vs. S3), and no path-length bounds. An attacker with valid cluster credentials or node access can propose Raft entries registering arbitrary paths (e.g., `/etc/passwd`, `s3://attacker-controlled-bucket/poisoned.parquet`, or `../../etc/shadow`), which are then written to the authoritative cluster manifest and replicated to every peer. Affected versions are prior to 2026.06.1; the fix validates paths, rejects parent-traversal and out-of-scope absolute paths, enforces backend-specific scheme validation, and applies length limits.
Affected products
- Basekick Labs Arc Enterprise <= 2026.05.1
Timeline
- 2026-05-31: disclosed: Advisory published on GitHub
- 2026-06-01: patched: Fixed in version 2026.06.1
- 2026-08-21: other: NVD entry published