MEDIUM GitHub
CVE-2026-55678
arc has unauthenticated cluster node admission when `cluster.shared_secret` is unset
## Summary
Arc Enterprise clustering accepts cluster join requests without authentication when `cluster.enabled=true` but `cluster.shared_secret` is not configured. The coordinator validates HMAC authentication only if a shared secret is non-empty; otherwise, a network attacker who can reach the coordinator port can send a join request with attacker-controlled node addresses and role. Accepted nodes are marked healthy, registered locally or added as Raft voters, and can be selected by the
clus
Affected Products
- go/github.com/basekick-labs/arc < 0.0.0-20260615160325-38402ad2ebdd
References
- https://github.com/advisories/GHSA-p378-jp5r-gpgw
- https://github.com/Basekick-Labs/arc/security/advisories/GHSA-p378-jp5r-gpgw
- https://github.com/Basekick-Labs/arc/pull/505
- https://github.com/Basekick-Labs/arc/commit/38402ad2ebddd32c15bf4a0fc9c22c920e5685df
This medium severity vulnerability was published on 2026-08-28 via GitHub. Affected: go/github.com/basekick-labs/arc < 0.0.0-20260615160325-38402ad2ebdd.
vulnfeed aggregates 11493 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.