Basekick-Labs Arc up to 2026.06.0 Cluster Replication Receiver receiver.go authentication replay

Summaryinfo

A vulnerability classified as critical was found in Basekick-Labs Arc up to 2026.06.0. The affected element is an unknown function of the file internal/cluster/replication/receiver.go of the component Cluster Replication Receiver. Such manipulation leads to authentication replay. This vulnerability is listed as CVE-2026-48106. The attack may be performed from remote. There is no available exploit.

Detailsinfo

A vulnerability was found in Basekick-Labs Arc up to 2026.06.0 and classified as critical. Affected by this issue is an unknown function of the file internal/cluster/replication/receiver.go of the component Cluster Replication Receiver. The manipulation with an unknown input leads to a authentication replay vulnerability. Using CWE to declare the problem leads to CWE-294. A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes). Impacted is confidentiality, integrity, and availability. CVE summarizes:

Arc is an open, SQL-native time-series database for telemetry. Prior to version 26.06.1, Arc Enterprise's cluster replication receiver at `internal/cluster/replication/receiver.go` validates only the wire-format envelope (length, opcode) of inbound messages. The `MsgReplicateSync` payload itself is accepted without any application-layer authentication — no HMAC, no signature, no per-message nonce. The replication stream is protected at the transport layer by TLS / mTLS, but there is no protection against application-layer message tampering or replay once a peer is on the cluster network. This is fixed in 2026.06.1. Some workarounds are available. Restrict cluster network access to known-trusted peers via strict firewall rules, audit replication logs for unexpected `MsgReplicateSync` traffic, and/or disable cluster mode until the fix is available.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-48106 since 05/20/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1040.

Upgrading to version 2026.06.1 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• Basekick-Labs

Name

• Arc

Version

• 2026.06

Website

• Product: https://github.com/Basekick-Labs/arc/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion