Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-55678— Arc: Unauthenticated cluster node admission when `cluster.shared_secret` is unset

Quick assessment

Affected
Basekick-Labs arc
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Basekick Labs Arc是Basekick Labs组织的一款开放式、原生 SQL 的时序数据库。 Basekick-Labs Arc 26.02.1版本至26.06.2之前版本存在安全漏洞，该漏洞源于Arc Enterprise集群在启用cluster.enabled但未配置cluster.shared_secret时接受未经认证的集群加入请求，可能导致未经身份验证的网络攻击者成为受信任集群节点、篡改集群成员资格、拦截转发请求或导致流量黑洞和延迟。

CVSS 6.9 · Medium EPSS 0.66% · P52

Affected Version Matrix 1

VendorProduct Version RangeStatus
Basekick-Labs arc >= 26.02.1, < 26.06.2 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-55678

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Arc: Unauthenticated cluster node admission when `cluster.shared_secret` is unset
Source: CVE Program / CVE List V5
Vulnerability Description
Arc is an open, SQL-native time-series database for telemetry. From 26.02.1 until 26.06.2, Arc Enterprise clustering accepts cluster join requests without authentication when cluster.enabled is true but cluster.shared_secret is not configured. The defaults in internal/config/config.go set cluster.enabled to false, cluster.cluster_name to arc-cluster, cluster.coordinator_addr to :9100, cluster.shared_secret to an empty value, and cluster.tls_enabled to false, while cmd/arc/main.go requires cluster.shared_secret only when cluster.replication_enabled is true. JoinRequest in internal/cluster/protocol/messages.go accepts attacker-controlled node_id, role, raft_addr, api_addr, and coord_addr values, plus optional auth_nonce, auth_timestamp, and auth_hmac fields. The join path in internal/cluster/coordinator.go validates HMAC authentication only when the configured shared secret is non-empty and otherwise proceeds after only the cluster-name check. An accepted node is marked healthy, added as a Raft voter or registered locally, and becomes available through internal/cluster/registry.go to the routing logic in internal/cluster/router.go. The forwardRequest path in internal/cluster/router.go builds its target from node.APIAddress and copies Authorization and x-api-key headers with the request, so a rogue node selected for a forwarded query or write can receive authentication headers, request bodies, database and measurement names, and operational metadata. Heartbeat in internal/cluster/protocol/messages.go also lacks HMAC fields, and internal/cluster/coordinator.go updates node state from supplied node_id and state values without authentication. An unauthenticated network attacker who can reach the coordinator port and knows the cluster name can therefore become a trusted cluster node, mutate cluster membership, be submitted as a Raft voter, intercept topology-dependent forwarded requests, divert or forge operations, and blackhole or delay traffic. The default standalone configuration is not reachable because cluster.enabled is false, but Enterprise cluster deployments with clustering enabled and no shared secret are affected. This issue is fixed in version 26.06.2.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
访问控制不恰当
Source: CVE Program / CVE List V5
Vulnerability Title
Basekick-Labs Arc 权限许可和访问控制问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Basekick Labs Arc是Basekick Labs组织的一款开放式、原生 SQL 的时序数据库。 Basekick-Labs Arc 26.02.1版本至26.06.2之前版本存在安全漏洞，该漏洞源于Arc Enterprise集群在启用cluster.enabled但未配置cluster.shared_secret时接受未经认证的集群加入请求，可能导致未经身份验证的网络攻击者成为受信任集群节点、篡改集群成员资格、拦截转发请求或导致流量黑洞和延迟。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Basekick-Labs arc >= 26.02.1, < 26.06.2 -

II. Public POCs for CVE-2026-55678

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-55678

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-55678 (2)

Vendor Advisories for CVE-2026-55678 (1)

Vendor Pages for CVE-2026-55678 (1)

IV. Related Vulnerabilities

Same product: arc
Same vendor: Basekick-Labs
Same weakness: CWE-284