CVE-2026-48106

Katalog CVE

CVSS 8.3 · High EPSS 0,22%

Kerentanan Missing Authentication for Critical Function. Skor CVSS 4.0 8.3 (High) menurut github.com.

Deskripsi (NVD)

Arc is an open, SQL-native time-series database for telemetry. Prior to version 26.06.1, Arc Enterprise's cluster replication receiver at `internal/cluster/replication/receiver.go` validates only the wire-format envelope (length, opcode) of inbound messages. The `MsgReplicateSync` payload itself is accepted without any application-layer authentication — no HMAC, no signature, no per-message nonce. The replication stream is protected at the transport layer by TLS / mTLS, but there is no protection against application-layer message tampering or replay once a peer is on the cluster network. This is fixed in 2026.06.1. Some workarounds are available. Restrict cluster network access to known-trusted peers via strict firewall rules, audit replication logs for unexpected `MsgReplicateSync` traffic, and/or disable cluster mode until the fix is available.

Rincian

Terbit di NVD

21 Agustus 2026

Terakhir diubah

12 Oktober 2026

Status NVD

Deferred

CVSS 4.0

8.3 (High), sumber github.com
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-306: Missing Authentication for Critical Function
CWE-345: Insufficient Verification of Data Authenticity
CWE-924: Improper Enforcement of Message Integrity During Transmission in a Communication Channel

EPSS (30 hari)

0,22% peluang dieksploitasi; lebih tinggi dari 12,0% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/Basekick-Labs/arc/security/advisories/GHSA-wfgr-8x84-22q7