CyberRota Analysis
AI-GeneratedArc Enterprise versions prior to 26.06.1 are vulnerable due to insufficient validation of the `MsgReplicateSync` payload in the cluster replication process, allowing for potential message tampering or replay attacks. While the transport layer is secured with TLS/mTLS, the lack of application-layer authentication poses a significant risk to data integrity within the cluster. Organizations using Arc Enterprise should prioritize this vulnerability to protect against unauthorized replication and ensure that only trusted peers can access the cluster network.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Arc is an open, SQL-native time-series database for telemetry. Prior to version 26.06.1, Arc Enterprise's cluster replication receiver at `internal/cluster/replication/receiver.go` validates only the wire-format envelope (length, opcode) of inbound messages. The `MsgReplicateSync` payload itself is accepted without any application-layer authentication — no HMAC, no signature, no per-message nonce. The replication stream is protected at the transport layer by TLS / mTLS, but there is no protection against application-layer message tampering or replay once a peer is on the cluster network. This is fixed in 2026.06.1. Some workarounds are available. Restrict cluster network access to known-trusted peers via strict firewall rules, audit replication logs for unexpected `MsgReplicateSync` traffic, and/or disable cluster mode until the fix is available.