CVE-2026-48106

Arc is an open, SQL-native time-series database for telemetry. Prior to version 26.06.1, Arc Enterprise's cluster replication receiver at `internal/cluster/replication/receiver.go` validates only the wire-format envelope (length, opcode) of inbound messages. The `MsgReplicateSync` payload itself is accepted without any application-layer authentication — no HMAC, no signature, no per-message nonce. The replication stream is protected at the transport layer by TLS / mTLS, but there is no protection against application-layer message tampering or replay once a peer is on the cluster network. This is fixed in 2026.06.1. Some workarounds are available. Restrict cluster network access to known-trusted peers via strict firewall rules, audit replication logs for unexpected `MsgReplicateSync` traffic, and/or disable cluster mode until the fix is available.

• CWE-306
• CWE-345
• CWE-924

• https://github.com/Basekick-Labs/arc/security/advisories/GHSA-wfgr-8x84-22q7

Published

Aug 21, 2026

Last Modified

Sep 9, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-4810A Code Injection and Missing Authentication vulnerability in…9.3
• CVE-2026-481017-Zip is a file archiver with a high compression ratio. Vers…6.5
• CVE-2026-481027-Zip is a file archiver with a high compression ratio. Vers…4.3
• CVE-2026-481037-Zip is a file archiver with a high compression ratio. Vers…7.1
• CVE-2026-481047-Zip is a file archiver with a high compression ratio. Vers…4.2
• CVE-2026-48105Arc is an open, SQL-native time-series database for telemetr…8.3
• CVE-2026-48107Russh is a Rust SSH client & server library. From version 0.…6.5
• CVE-2026-48108Russh is a Rust SSH client & server library. From version 0.…5.3
• CVE-2026-48109MessagePack for C# is a MessagePack serializer for C#. Prior…8.2
• CVE-2026-4811The WPB Floating Menu & Categories for WordPress – Sticky Si…4.9
• CVE-2026-48110Russh is a Rust SSH client & server library. From version 0.…7.5
• CVE-2026-481117-Zip is a file archiver with a high compression ratio. Vers…7.1