CVE-2026-48106
Gravedad CVSS v4.0:
ALTA
Tipo:
CWE-306
Ausencia de autenticación para una función crítica
Fecha de publicación:
21/08/2026
Última modificación:
21/08/2026
Descripción
*** Pendiente de traducción *** Arc is an open, SQL-native time-series database for telemetry. Prior to version 26.06.1, Arc Enterprise's cluster replication receiver at `internal/cluster/replication/receiver.go` validates only the wire-format envelope (length, opcode) of inbound messages. The `MsgReplicateSync` payload itself is accepted without any application-layer authentication — no HMAC, no signature, no per-message nonce. The replication stream is protected at the transport layer by TLS / mTLS, but there is no protection against application-layer message tampering or replay once a peer is on the cluster network. This is fixed in 2026.06.1. Some workarounds are available. Restrict cluster network access to known-trusted peers via strict firewall rules, audit replication logs for unexpected `MsgReplicateSync` traffic, and/or disable cluster mode until the fix is available.
Impacto
Puntuación base 4.0
8.30
Gravedad 4.0
ALTA