DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-55678: CVE-2026-55678: Unauthenticated Node Registration and Credential Leakage in Arc Enterprise Clustering

#security #cve #cybersecurity

CVE-2026-55678: Unauthenticated Node Registration and Credential Leakage in Arc Enterprise Clustering

Vulnerability ID: CVE-2026-55678
CVSS Score: 6.9
Published: 2026-08-28

CVE-2026-55678 defines a critical security vulnerability in the Enterprise clustering implementation of Arc, an open-source SQL-native time-series database. When clustering is enabled but a shared secret is not defined, the cluster coordinator fails to enforce authentication on cluster join requests and node status updates. Remote, unauthenticated attackers can exploit this behavior to register a rogue node, hijack telemetry routing, and harvest sensitive client authentication headers.

TL;DR

Unauthenticated remote attackers can register rogue nodes in Arc database clusters, enabling silent query interception and extraction of administrative API keys.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-287, CWE-284, CWE-306
  • Attack Vector: Network
  • CVSS v4.0 Score: 6.9 (Medium)
  • Exploit Status: Proof of Concept (PoC) available
  • CISA KEV Status: Not Listed
  • Ransomware Association: No known utilization in ransomware campaigns

Affected Systems

  • Arc Enterprise Cluster Coordinator
  • arc: >= 26.02.1, < 26.06.2 (Fixed in: 26.06.2)

Code Analysis

Commit: 38402ad

Fix unauthenticated cluster join and heartbeat spoofing (GHSA-p378-jp5r-gpgw)

Exploit Details

  • GitHub Security Advisory: GHSA-p378-jp5r-gpgw advisory description containing details about the missing authentication check.

Mitigation Strategies

  • Mandatory upgrade of all cluster members and coordinators to Arc v26.06.2 or later.
  • Enforce strong administrative secrets across clustering endpoints by declaring ARC_CLUSTER_SHARED_SECRET via host environment variables.
  • Utilize network access control lists (ACLs) to block external requests to coordinator port 9100.
  • Enable TLS transport security for all peer-to-peer and coordinator-to-node telemetry traffic.

Remediation Steps:

  1. Generate a cryptographically secure 32-byte shared secret using commands such as 'openssl rand -hex 32'.
  2. Configure the environment variable 'ARC_CLUSTER_SHARED_SECRET' with the generated value across all cluster hosts.
  3. Perform a coordinated rolling upgrade of the Arc database package to v26.06.2.
  4. Verify cluster synchronization logs to confirm that all nodes are establishing signed heartbeat tunnels successfully.

References

Read the full report for CVE-2026-55678 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)