CVE-2026-55678

Deferred Deferred - Pending Action

Unauthenticated Cluster Join in Arc Enterprise

Publication date: 2026-08-28

Last updated on: 2026-09-09

Assigner: GitHub, Inc.

Description

Arc is an open, SQL-native time-series database for telemetry. From 26.02.1 until 26.06.2, Arc Enterprise clustering accepts cluster join requests without authentication when cluster.enabled is true but cluster.shared_secret is not configured. The defaults in internal/config/config.go set cluster.enabled to false, cluster.cluster_name to arc-cluster, cluster.coordinator_addr to :9100, cluster.shared_secret to an empty value, and cluster.tls_enabled to false, while cmd/arc/main.go requires cluster.shared_secret only when cluster.replication_enabled is true. JoinRequest in internal/cluster/protocol/messages.go accepts attacker-controlled node_id, role, raft_addr, api_addr, and coord_addr values, plus optional auth_nonce, auth_timestamp, and auth_hmac fields. The join path in internal/cluster/coordinator.go validates HMAC authentication only when the configured shared secret is non-empty and otherwise proceeds after only the cluster-name check. An accepted node is marked healthy, added as a Raft voter or registered locally, and becomes available through internal/cluster/registry.go to the routing logic in internal/cluster/router.go. The forwardRequest path in internal/cluster/router.go builds its target from node.APIAddress and copies Authorization and x-api-key headers with the request, so a rogue node selected for a forwarded query or write can receive authentication headers, request bodies, database and measurement names, and operational metadata. Heartbeat in internal/cluster/protocol/messages.go also lacks HMAC fields, and internal/cluster/coordinator.go updates node state from supplied node_id and state values without authentication. An unauthenticated network attacker who can reach the coordinator port and knows the cluster name can therefore become a trusted cluster node, mutate cluster membership, be submitted as a Raft voter, intercept topology-dependent forwarded requests, divert or forge operations, and blackhole or delay traffic. The default standalone configuration is not reachable because cluster.enabled is false, but Enterprise cluster deployments with clustering enabled and no shared secret are affected. This issue is fixed in version 26.06.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-09-09

Generated

2026-09-18

AI Q&A

2026-08-29

EPSS Evaluated

2026-09-15

NVD

CVE-2026-55678

Affected Vendors & Products

Vendor	Product	Version / Range
arc	arc	From 26.02.1 (inc) to 26.06.2 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
CWE-287	When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

Executive Summary

This vulnerability in Arc, a SQL-native time-series database, allows unauthenticated attackers to join an Enterprise cluster and become trusted nodes. It occurs when clustering is enabled but no shared secret is configured. Attackers can then intercept, divert, or forge operations and manipulate cluster membership.

Detection Guidance

Check if Arc Enterprise clustering is enabled without a shared secret. Verify cluster.enabled is true and cluster.shared_secret is empty. Inspect network traffic for unauthorized join requests to the coordinator port (default 9100). Look for unexpected nodes in the cluster registry or Raft voter lists.

Impact Analysis

An attacker could gain access to sensitive data, manipulate database operations, or disrupt cluster functionality. They might intercept forwarded requests containing authentication headers, database names, or operational metadata, potentially leading to data breaches or service disruptions.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or health data, violating GDPR and HIPAA requirements for data protection and access controls. Organizations using affected Arc versions may face compliance violations and potential legal consequences.

Mitigation Strategies

Upgrade Arc to version 26.06.2 or later. Ensure cluster.shared_secret is configured if clustering is enabled. Disable clustering (set cluster.enabled to false) if not required. Restrict network access to the coordinator port (9100) to trusted sources only.

Hi! I’m here to help you understand CVE-2026-55678. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70