CVE-2026-48105 Overview
CVE-2026-48105 is a path traversal vulnerability [CWE-22] in Arc, an open, SQL-native time-series database for telemetry data. The flaw resides in Arc Enterprise's Raft finite state machine (FSM), specifically the applyRegisterFile function in internal/cluster/raft/fsm.go. The function accepts attacker-chosen file paths in manifest-registration proposals without validating them against the configured storage backend.
An authenticated cluster peer can submit manifest proposals containing arbitrary paths, including traversal sequences, remote URLs, or unrestricted local paths. The issue affects Arc Enterprise versions prior to 26.06.1 and is fixed in release 2026.06.1.
Critical Impact
A low-privileged network attacker with cluster access can register arbitrary file paths into the Raft-replicated manifest, corrupting cluster state and integrity across all peers.
Affected Products
- Arc Enterprise (Basekick Labs) prior to version 2026.06.1
- Arc clusters running the Raft FSM applyRegisterFile code path
- Deployments operating in cluster mode with manifest-registration enabled
Discovery Timeline
- 2026-08-21 - CVE-2026-48105 published to NVD
- 2026-08-24 - Last updated in NVD database
Technical Details for CVE-2026-48105
Vulnerability Analysis
Arc uses the Raft consensus protocol to replicate cluster state across peers. When a node registers a file in the manifest, the proposal flows through the Raft FSM's applyRegisterFile handler in internal/cluster/raft/fsm.go. This handler commits the supplied path to replicated state on every peer.
The handler validates only that the supplied path string is non-empty. It performs no parent-directory traversal rejection for .. sequences, no allowlist enforcement against legitimate storage prefixes, no scheme restriction between s3:// URLs and local filesystem paths, and no upper bound on path length.
An attacker who can submit Raft proposals can therefore register paths outside the configured storage backend root. Registered entries propagate to every cluster peer as authoritative manifest state, breaking the integrity guarantees that downstream queries and storage operations depend on.
Root Cause
The root cause is missing input validation on a security-relevant path parameter that crosses a trust boundary into replicated cluster state. The applyRegisterFile function treats the manifest path field as opaque data rather than as a controlled reference into the configured storage backend. Without an allowlist of legitimate prefixes or a canonicalization step, the FSM cannot distinguish a legitimate registration from an attacker-crafted one.
Attack Vector
Exploitation requires network access to the Raft cluster transport and authenticated peer credentials sufficient to submit proposals. The attacker crafts a manifest-registration proposal containing a path such as a traversal string, an unrelated s3:// URI, or an oversized local path. Once accepted, the Raft log commits the entry and every peer applies it. The result is integrity compromise of the manifest and, by extension, of query results and storage operations that rely on it. Refer to the GitHub Security Advisory GHSA-f85q-mvg8-qf37 for the vendor's technical description.
Detection Methods for CVE-2026-48105
Indicators of Compromise
- Manifest entries containing .. parent-traversal sequences or absolute paths outside the configured storage backend root
- Manifest entries whose URI scheme does not match the configured backend, such as s3:// paths on a local-storage cluster or arbitrary local paths on an object-storage cluster
- Unusually long path strings in applyRegisterFile Raft log entries
- Unexpected Raft proposals originating from peers or source addresses not on the trusted operator list
Detection Strategies
- Audit the current cluster manifest and flag any path that does not match the configured storage backend root prefix
- Parse Raft log entries for applyRegisterFile operations and compare committed paths against an allowlist of legitimate prefixes
- Correlate manifest changes with authenticated peer identities to identify proposals from unexpected sources
Monitoring Recommendations
- Alert on any new manifest path that contains .., mixed schemes, or lies outside the storage backend root
- Monitor Raft transport connections and flag inbound peer sessions from IP addresses outside the documented cluster peer set
- Track version and build metadata across Arc nodes to confirm all peers run the patched 2026.06.1 release
How to Mitigate CVE-2026-48105
Immediate Actions Required
- Upgrade all Arc Enterprise nodes to version 2026.06.1 or later, which adds validation in applyRegisterFile
- Enforce strict firewall rules that restrict Raft cluster network access to known-trusted peer addresses only
- Audit the current cluster manifest and remove or quarantine any path that does not match the configured storage backend root
Patch Information
The vulnerability is fixed in Arc release 2026.06.1. The patched applyRegisterFile function validates manifest paths against the configured storage backend before committing them to Raft state. See the GitHub Security Advisory GHSA-f85q-mvg8-qf37 for release notes and upgrade guidance.
Workarounds
- Restrict cluster network access to known-trusted peers using strict firewall rules on the Raft transport port
- Audit the cluster manifest for unexpected paths, treating any entry that does not match the configured storage backend root as suspect
- Disable cluster mode and operate Arc in single-node configuration until the patched build is deployed
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
