CVE-2026-48105 in Arc
Summary
by MITRE • 08/22/2026
Arc is an open, SQL-native time-series database for telemetry. Prior to version 26.06.1, Arc Enterprise's Raft FSM (`internal/cluster/raft/fsm.go:applyRegisterFile`) accepts attacker-chosen file paths in manifest-registration proposals without validating them against the configured storage backend. The only check is that the path is non-empty. There is no parent-traversal (`..`) rejection, no allowlist of legitimate prefixes, no scheme restriction (`s3://` vs local), and no length bound. This is fixed in 2026.06.1. Some workarounds are available. Restrict cluster network access to known-trusted peers via strict firewall rules, audit the cluster manifest for unexpected paths (any path not matching the configured storage backend root is suspect), and/or disable cluster mode until the fix is available.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/22/2026
The vulnerability identified in Arc Enterprise prior to version 26.06.1 represents a critical directory traversal and arbitrary file write flaw rooted in insufficient input validation within the Raft consensus mechanism's state machine implementation. Specifically, the function applyRegisterFile located at internal/cluster/raft/fsm.go fails to sanitize or validate file paths provided by attackers during manifest-registration proposals. While the system performs a basic check to ensure that the submitted path is not empty, it completely lacks robust security controls such as rejection of parent-traversal sequences like double dots, enforcement of allowlists for legitimate storage prefixes, restriction of URL schemes to prevent access via protocols like S3 versus local file systems, and application of length bounds. This deficiency allows an authenticated attacker who can interact with the Raft consensus protocol to specify arbitrary paths on the underlying operating system where Arc is deployed.
From a technical perspective, this flaw aligns closely with CWE-22 Improper Limitation of a Pathname to a Restricted Directory, as well as CWE-73 External Control of File Name or Path. The absence of path canonicalization and validation means that an attacker can manipulate the file system structure by writing files outside intended directories, potentially overwriting critical configuration files, injecting malicious scripts, or establishing persistence mechanisms within the Arc data directory. Since this vulnerability exists in the Raft FSM component responsible for applying cluster-wide state changes, exploitation does not require breaking out of a sandboxed environment but rather leveraging legitimate administrative functions to execute unauthorized file system operations. The impact is severe because it compromises both confidentiality and integrity of the telemetry database infrastructure, potentially leading to full remote code execution if combined with other vulnerabilities or misconfigurations in the hosting environment.
The operational impact extends beyond simple data corruption; an attacker could disrupt service availability by overwriting essential Arc binaries or configuration files, causing cluster instability or complete outage. Furthermore, because Arc is designed as a time-series database for telemetry, compromising its integrity may lead to inaccurate monitoring and alerting capabilities, masking further malicious activities within the network. The lack of scheme restriction also introduces risks related to CWE-436 Interpretation Conflict if different components interpret paths differently based on context, although in this case the primary risk is direct file system manipulation due to missing validation logic.
Mitigation strategies should focus on immediate containment and long-term remediation. Organizations must restrict cluster network access strictly to known-trusted peers using rigorous firewall rules to limit exposure of the Raft consensus endpoints to unauthorized actors. It is also advisable to audit existing cluster manifests for any unexpected paths that do not align with the configured storage backend root, as these may indicate prior exploitation attempts or misconfigurations. Disabling cluster mode until version 26.06.1 is deployed provides an effective temporary workaround by removing the attack surface associated with distributed consensus operations. Finally, upgrading to Arc Enterprise version 26.06.1 or later is essential, as this release includes proper input validation and path sanitization mechanisms that address these deficiencies in accordance with secure coding standards such as those outlined in OWASP guidelines for file upload and storage security.