CVE-2026-55678: CWE-284: Improper Access Control in Basekick-Labs arc

Arc Enterprise clustering accepts cluster join requests without authentication if cluster.enabled is true but cluster.shared_secret is empty. The join request accepts attacker-controlled parameters and proceeds after only verifying the cluster name, bypassing HMAC authentication. An attacker can become a trusted cluster node, gain Raft voter status, intercept forwarded requests with sensitive headers, and manipulate cluster state. The vulnerability affects versions from 26.02.1 until fixed in 26.06.2. The default standalone configuration is not vulnerable as clustering is disabled by default. No known exploits in the wild have been reported.

An unauthenticated network attacker who can reach the coordinator port and knows the cluster name can join the cluster as a trusted node, manipulate cluster membership including Raft voters, intercept forwarded requests containing authentication headers and sensitive data, and disrupt cluster operations by blackholing or delaying traffic. This compromises cluster integrity, confidentiality of forwarded requests, and availability of cluster services in affected deployments.

This vulnerability is fixed in Arc version 26.06.2. Users should upgrade to version 26.06.2 or later. Deployments should ensure that if clustering is enabled, a non-empty shared secret is configured to enforce authentication on cluster join requests. The default standalone configuration with clustering disabled is not affected. Patch status is not explicitly stated beyond the fix in 26.06.2; users should consult the vendor advisory for the latest remediation guidance.