Arc Enterprise Cluster-Wide Path Traversal Worm Primitive via FSM (CVE-2026-48105)

Vulnerability Overview The function in Arc Enterprise clusters accepts arbitrary file paths without validation, leading to a cluster-wide path traversal worm primitive. Scope Affected Versions: = 2026.06.1 Severity: Critical CVE ID: CVE-2026-48105 Weaknesses: - CWE-22 - CWE-345 - CWE-913 Impact Once an attacker possesses valid cluster credentials (see X1 - Cluster replication lacks HMAC) or compromises a single cluster node, they can issue Raft proposals using arbitrary paths: as the “cluster data file” — other nodes will retrieve this file, and queries will read host-level files outside the Arc storage root. — every cluster reader will pull attacker-controlled data into query results. via parent path traversal — depending on how the storage backend resolves paths, but most backends allow this. Paths are directly recorded in the authoritative Raft log and replicated to other nodes. Other nodes treat them as legitimate entries within the cluster data plane. This constitutes a “worm primitive” — compromise of a single node propagates across the cluster. Combined with X1 (no HMAC on ), an attacker can transition from “network presence” to “full cluster data plane control” using a single valid certificate, without further exploitation. Remediation Patch [TBD: Link to merged PR] The planned fix for includes: 1. Reject any path containing (parent path traversal). 2. Reject any absolute path that does not match the configured storage backend root ( for local, for S3, etc.). 3. Reject any URL scheme different from the configured storage backend (e.g., reject when the backend is local, reject local paths when the backend is S3). 4. Apply a length limit (e.g., 4096 bytes — typical POSIX ). Existing logs are scanned at startup; failed entries are quarantined (logged at Error level and skipped during reads) rather than silently accepted. Therefore, computed logs from previous proposals will not automatically re-enable the vulnerability after an upgrade. Workaround Restrict cluster network access to known trusted peers via strict firewall rules. Audit cluster logs for unexpected paths (any paths not matching the configured storage backend root, if the storage backend root itself is suspect). Disable cluster mode until a fix is available. Credit Reported by Alex Manson (@NeuroWinter, https://neurowinter.com/) on 2026-05-19.

Goal Reached Thanks to every supporter — we hit 100%!

Arc Enterprise Cluster-Wide Path Traversal Worm Primitive via FSM (CVE-2026-48105)

More from this source