Executive brief
Arc Enterprise is a time-series database used for monitoring and telemetry data in clustered deployments. The cluster replication feature accepts data synchronization messages without application-layer authentication, allowing any node with a valid cluster certificate to inject, modify, or replay data across the entire cluster. An attacker with access to a peer node's credentials could silently corrupt or overwrite critical telemetry data without detection.
Technical details
The vulnerability is a missing authentication check in Arc Enterprise's cluster replication receiver (`internal/cluster/replication/receiver.go`). The component validates only the wire-format envelope of inbound `MsgReplicateSync` messages but accepts the payload without HMAC, signature, or nonce verification. Although the replication stream uses TLS/mTLS for transport-layer encryption, this only confirms peer identity on the cert chain—it does not prevent message tampering or replay by a compromised peer already on the cluster network. An attacker with a valid mTLS certificate can inject arbitrary records, overwrite legitimate replicated data, or perform replay attacks. The fix, available in version 2026.06.1, adds HMAC-based message authentication using a cluster-shared secret, timestamp validation, and replay protection via nonce cache.
Affected products
- Basekick Labs Arc Enterprise <= 2026.05.1
Timeline
- 2026-05-31: disclosed: GitHub advisory GHSA-wfgr-8x84-22q7 published
- 2026-08-21: advisory: CVE-2026-48106 published on NVD
- 2026-06-01: patched: Fix available in Arc Enterprise version 2026.06.1