CVE-2026-48106

Arc is an open, SQL-native time-series database for telemetry. Prior to version 26.06.1, Arc Enterprise's cluster replication receiver at "internal/cluster/replication/receiver.go" validates only the wire-format envelope length, opcode of inbound messages. The "MsgReplicateSync" payload itself is...

CVE-2026-48106 Arc Enterprise cluster replication accepts unauthenticated MsgReplicateSync messages, enabling cluster-wide data injection from any TLS-trusted peer

Arc is an open, SQL-native time-series database for telemetry. Prior to version 26.06.1, Arc Enterprise's cluster replication receiver at internal/cluster/replication/receiver.go validates only the wire-format envelope length, opcode of inbound messages. The MsgReplicateSync payload itself is...

CVE-2026-48106: Missing Authentication for Critical Function

Arc is an open, SQL-native time-series database for telemetry. Prior to version 26.06.1, Arc Enterprise's cluster replication receiver at internal/cluster/replication/receiver.go validates only the wire-format envelope length, opcode of inbound messages. The MsgReplicateSync payload itself is...