CVE-2026-55678: Unauthenticated Cluster Node Admission in Arc Package
Summary
CVE-2026-55678: arc has unauthenticated cluster node admission when cluster.shared_secret is unset. Affects github.com/basekick-labs/arc versions < 0.0.0-20260615160325-38402ad2ebdd. Fixed in 0.0.0-20260615160325-38402ad2ebdd. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Arc is an open-source enterprise clustering solution designed to facilitate distributed systems by allowing multiple nodes to join and communicate securely. It provides features such as data replication, load balancing, and fault tolerance. However, a critical vulnerability exists when the cluster.shared_secret is not configured, leading to potential unauthorized access and manipulation of cluster nodes.
Vulnerability Detail
The vulnerability arises from Arc's handling of cluster join requests. When clustering is enabled but the shared secret is unset, the coordinator accepts join requests without proper authentication. This allows an attacker to send malicious join requests, potentially compromising the cluster's integrity by adding unauthorized nodes. The attacker can intercept authenticated requests, manipulate data, and affect the overall availability of the cluster. The vulnerability is exacerbated by default configurations that leave the shared secret empty and TLS disabled, making it easier for attackers to exploit the system.
How To Fix
Latest published version: v25.11.2+incompatible as of 22 Oct 2026
go get github.com/basekick-labs/arc@v25.11.2+incompatibleUpgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.0.0-20260615160325-38402ad2ebdd
This is the first release that contains the fix.
go get github.com/basekick-labs/arc@v0.0.0-20260615160325-38402ad2ebddTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, if you cannot update the package immediately, disable clustering by setting cluster.enabled=false in your configuration file. This will prevent any unauthorized join requests until a proper fix can be applied.
Conclusion
CVE-2026-55678 presents a significant security risk for users of the Arc package, allowing unauthorized access to cluster nodes when the shared secret is not configured. It is crucial to apply the recommended fixes and monitor your systems for vulnerabilities to maintain security and integrity.
See every vulnerability recorded for github.com/basekick-labs/arc →
FAQ
CVE-2026-55678 is a vulnerability in the Arc package that allows unauthenticated cluster node admission when the shared secret is not configured.
An attacker can exploit this vulnerability to add unauthorized nodes to your cluster, intercept authenticated requests, and manipulate data, leading to potential data breaches and availability issues.
Yes, a patch is available in the version 0.0.0-20260615160325-38402ad2ebdd. It is recommended to update to this version to mitigate the vulnerability.
As a temporary measure, disable clustering by setting cluster.enabled=false in your configuration file to prevent unauthorized access.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities in your software. You can check if your application is affected by this vulnerability using the Vulert playground.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/basekick-labs/arc.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.