CVE-2026-48106

Received Received - Intake

Arc Enterprise Cluster Replication Message Tampering Vulnerability

Publication date: 2026-08-21

Last updated on: 2026-08-21

Assigner: GitHub, Inc.

Description

Arc is an open, SQL-native time-series database for telemetry. Prior to version 26.06.1, Arc Enterprise's cluster replication receiver at `internal/cluster/replication/receiver.go` validates only the wire-format envelope (length, opcode) of inbound messages. The `MsgReplicateSync` payload itself is accepted without any application-layer authentication — no HMAC, no signature, no per-message nonce. The replication stream is protected at the transport layer by TLS / mTLS, but there is no protection against application-layer message tampering or replay once a peer is on the cluster network. This is fixed in 2026.06.1. Some workarounds are available. Restrict cluster network access to known-trusted peers via strict firewall rules, audit replication logs for unexpected `MsgReplicateSync` traffic, and/or disable cluster mode until the fix is available.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-21

Last Modified

2026-08-21

Generated

2026-08-22

AI Q&A

2026-08-22

EPSS Evaluated

N/A

NVD

CVE-2026-48106

Affected Vendors & Products

Vendor	Product	Version / Range
arc	arc	to 26.06.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-924	The product establishes a communication channel with an endpoint and receives a message from that endpoint, but it does not sufficiently ensure that the message was not modified during transmission.
CWE-345	The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

This vulnerability affects Arc, an open SQL-native time-series database. The issue is in the cluster replication receiver which only validates the basic structure of incoming messages (length and opcode) but does not verify the actual payload integrity. Messages like MsgReplicateSync are accepted without application-layer authentication such as HMAC or signatures. While transport layer security like TLS/mTLS is used, there is no protection against message tampering or replay once a peer is on the cluster network.

Detection Guidance

Monitor for unexpected MsgReplicateSync traffic in replication logs. Check firewall rules to ensure cluster network access is restricted to trusted peers only. Disable cluster mode temporarily if suspicious activity is detected.

Impact Analysis

An attacker with access to the cluster network could tamper with replication messages or replay old messages, potentially corrupting the database or causing inconsistencies. This could lead to data loss, incorrect telemetry data, or unauthorized changes in the time-series database. The impact depends on whether the cluster network is exposed to untrusted parties.

Compliance Impact

This vulnerability may impact compliance with GDPR and HIPAA due to insufficient application-layer protections for replication messages. Without authentication or integrity checks, unauthorized message tampering or replay could lead to data integrity issues, violating GDPR's accuracy principle and HIPAA's integrity requirements for protected health information.

Mitigation Strategies

Restrict cluster network access to known-trusted peers via strict firewall rules. Audit replication logs for unexpected MsgReplicateSync traffic. Disable cluster mode until the fix (version 26.06.1) is applied.

Hi! I’m here to help you understand CVE-2026-48106. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70