# CVE-2026-48106: Arc Enterprise cluster replication unauthenticated message acceptance

Source: https://junglewise.ai/threats/cve-2026-48106-arc-enterprise-cluster-replication-unauthenticated-message  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-21. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-48106 · Severity: info · CVSS 7.5 · Published 2026-08-21

Arc Enterprise is a time-series database used for monitoring and telemetry data in clustered deployments. The cluster replication feature accepts data synchronization messages without application-layer authentication, allowing any node with a valid cluster certificate to inject, modify, or replay data across the entire cluster. An attacker with access to a peer node's credentials could silently corrupt or overwrite critical telemetry data without detection.

Vendors: [Basekick Labs](https://junglewise.ai/threats/vendors/basekick-labs).

## Quick answers

**Is CVE-2026-48106 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-48106 being exploited in the wild.

**How severe is CVE-2026-48106?** Informational severity, with a CVSS score of 7.5, published 21 August 2026.

**Which products and versions are affected?** Basekick Labs Arc Enterprise <= 2026.05.1.

**Is there a fix for CVE-2026-48106?** A patch was published on 2026-06-01: Fix available in Arc Enterprise version 2026.06.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-48106 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-48106?** Check whether you run Basekick Labs Arc Enterprise at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a missing authentication check in Arc Enterprise's cluster replication receiver (`internal/cluster/replication/receiver.go`). The component validates only the wire-format envelope of inbound `MsgReplicateSync` messages but accepts the payload without HMAC, signature, or nonce verification. Although the replication stream uses TLS/mTLS for transport-layer encryption, this only confirms peer identity on the cert chain—it does not prevent message tampering or replay by a compromised peer already on the cluster network. An attacker with a valid mTLS certificate can inject arbitrary records, overwrite legitimate replicated data, or perform replay attacks. The fix, available in version 2026.06.1, adds HMAC-based message authentication using a cluster-shared secret, timestamp validation, and replay protection via nonce cache.

## Affected products

- Basekick Labs Arc Enterprise <= 2026.05.1

## Timeline

- 2026-05-31: disclosed: GitHub advisory GHSA-wfgr-8x84-22q7 published
- 2026-08-21: advisory: CVE-2026-48106 published on NVD
- 2026-06-01: patched: Fix available in Arc Enterprise version 2026.06.1

## References

- [https://github.com/Basekick-Labs/arc/security/advisories/GHSA-wfgr-8x84-22q7](https://github.com/Basekick-Labs/arc/security/advisories/GHSA-wfgr-8x84-22q7)

## Related threats

- [Arc Enterprise path traversal in Raft FSM file registration](https://junglewise.ai/threats/cve-2026-48105-arc-enterprise-path-traversal-in-raft-fsm-file-registration)