CVE-2026-55678

Name of the Vulnerable Software and Affected Versions Arc versions 26.02.1 through 26.06.1

Description Arc Enterprise clustering allows cluster join requests without authentication when cluster.enabled is set to true but cluster.shared secret is not configured. A network attacker who can reach the coordinator port and knows the cluster name can send a JoinRequest with attacker-controlled values for node id, role, raft addr, api addr, and coord addr. Because the coordinator only validates HMAC authentication if a shared secret is present, it may accept the rogue node as healthy and add it to the cluster trust state.

Once joined, the rogue node can be selected by the cluster router to receive forwarded requests. The forwardRequest path copies original Authorization and x-api-key headers to the target node, allowing the attacker to intercept authentication tokens, request bodies, and operational metadata. Additionally, the Heartbeat message lacks authentication, allowing attackers to update node state using a supplied node id. This can lead to unauthorized cluster membership mutation, interception of authenticated traffic, and the ability to divert, forge, or blackhole operations.

Recommendations Update to version 26.06.2. As a temporary mitigation, ensure that cluster.shared secret is configured with a non-empty value whenever cluster.enabled is set to true. Restrict network access to the coordinator port (default :9100) to trusted nodes only.