CVE-2026-48105: Arc Enterprise cluster FSM applyRegisterFile accepts arbitrary file paths without validation, enabling cluster-wide path-traversal worm primitive
Arc is an open, SQL-native time-series database for telemetry. Prior to version 26.06.1, Arc Enterprise's Raft FSM (internal/cluster/raft/fsm.go:applyRegisterFile) accepts attacker-chosen file paths in manifest-registration proposals without validating them against the configured storage backend. The only check is that the path is non-empty. There is no parent-traversal (..) rejection, no allowlist of legitimate prefixes, no scheme restriction (s3:// vs local), and no length bound. This is fixed in 2026.06.1. Some workarounds are available. Restrict cluster network access to known-trusted peers via strict firewall rules, audit the cluster manifest for unexpected paths (any path not matching the configured storage backend root is suspect), and/or disable cluster mode until the fix is available.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Arc Enterpriseto a version that resolves this vulnerability.Fixed in 26.06.1 - Configuration
Disable cluster mode until the fix is available.
Arc Enterprise cluster mode cluster_mode = disabled - Compensating control
Restrict Arc Enterprise cluster network access to known-trusted peers via strict firewall rules (cluster mode/workers should not accept connections from untrusted sources).
- Compensating control
Audit the cluster manifest for unexpected file paths: treat any path not matching the configured storage backend root as suspect.
Event History
Frequently Asked Questions
Which deployments are affected?
Arc Enterprise deployments running in cluster mode prior to version 26.06.1 are affected. The vulnerable code is in the Raft FSM manifest-registration path.
What does an attacker need to exploit this?
An attacker needs the ability to submit a manifest-registration proposal containing an attacker-chosen, non-empty file path. The path is not validated for traversal, approved prefixes, storage scheme, or length.
How can I check for signs of exploitation?
Audit the cluster manifest for unexpected paths. Any path that does not match the configured storage backend root should be treated as suspicious.
What can be done before upgrading?
Restrict cluster network access to known-trusted peers with strict firewall rules, audit manifests for unexpected paths, or disable cluster mode until the fix is available.
What version fixes the issue?
Upgrade to Arc Enterprise version 26.06.1 or later.