{"vulnerability": "cve-2026-55678", "sightings": [{"uuid": "262c9f44-4983-49df-a65d-16c0b53c40b6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55678", "type": "seen", "source": "https://gist.github.com/alon710/f6616451da7f3f1b989952d24a3d867c", "content": "# CVE-2026-55678: CVE-2026-55678: Unauthenticated Node Registration and Credential Leakage in Arc Enterprise Clustering\n\n> **CVSS Score:** 6.9\n> **Published:** 2026-08-28\n> **Full Report:** https://cvereports.com/reports/CVE-2026-55678\n\n## Summary\nCVE-2026-55678 defines a critical security vulnerability in the Enterprise clustering implementation of Arc, an open-source SQL-native time-series database. When clustering is enabled but a shared secret is not defined, the cluster coordinator fails to enforce authentication on cluster join requests and node status updates. Remote, unauthenticated attackers can exploit this behavior to register a rogue node, hijack telemetry routing, and harvest sensitive client authentication headers.\n\n## TL;DR\nUnauthenticated remote attackers can register rogue nodes in Arc database clusters, enabling silent query interception and extraction of administrative API keys.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-287, CWE-284, CWE-306\n- **Attack Vector**: Network\n- **CVSS v4.0 Score**: 6.9 (Medium)\n- **Exploit Status**: Proof of Concept (PoC) available\n- **CISA KEV Status**: Not Listed\n- **Ransomware Association**: No known utilization in ransomware campaigns\n\n## Affected Systems\n\n- Arc Enterprise Cluster Coordinator\n- **arc**: >= 26.02.1, < 26.06.2 (Fixed in: `26.06.2`)\n\n## Mitigation\n\n- Mandatory upgrade of all cluster members and coordinators to Arc v26.06.2 or later.\n- Enforce strong administrative secrets across clustering endpoints by declaring ARC_CLUSTER_SHARED_SECRET via host environment variables.\n- Utilize network access control lists (ACLs) to block external requests to coordinator port 9100.\n- Enable TLS transport security for all peer-to-peer and coordinator-to-node telemetry traffic.\n\n**Remediation Steps:**\n1. Generate a cryptographically secure 32-byte shared secret using commands such as 'openssl rand -hex 32'.\n2. Configure the environment variable 'ARC_CLUSTER_SHARED_SECRET' with the generated value across all cluster hosts.\n3. Perform a coordinated rolling upgrade of the Arc database package to v26.06.2.\n4. Verify cluster synchronization logs to confirm that all nodes are establishing signed heartbeat tunnels successfully.\n\n## References\n\n- [GHSA-p378-jp5r-gpgw: Arc Unauthenticated Join and Spoofing Advisory](https://github.com/Basekick-Labs/arc/security/advisories/GHSA-p378-jp5r-gpgw)\n- [Arc Coordinator Patch Commit](https://github.com/Basekick-Labs/arc/commit/38402ad2ebddd32c15bf4a0fc9c22c920e5685df)\n- [Arc v26.06.2 Release Changelog](https://github.com/Basekick-Labs/arc/releases/tag/v26.06.2)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-55678) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-28T21:31:53.803596Z"}, {"uuid": "e1205ac7-fb65-42e7-ab9e-c7550ca13952", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-55678", "type": "published-proof-of-concept", "source": "https://github.com/Basekick-Labs/arc/security/advisories/GHSA-p378-jp5r-gpgw", "content": "", "creation_timestamp": "2026-08-28T22:35:03.558887Z"}]}