Arc Enterprise, an open SQL‑native time‑series database, processes replicated cluster messages without application‑layer authentication. The MsgReplicateSync payload is accepted as long as the message envelope is valid, meaning an attacker can inject arbitrary data into the database once a peer is part of the cluster network. This vulnerability does not directly allow remote code execution, but it enables the modification or corruption of stored telemetry data, undermining the reliability of analysis and potential downstream decisions.

The vulnerability affects Basekick‑Labs’ Arc Enterprise product in all versions released before 26.06.1. Users running earlier releases that enable cluster replication are susceptible; any node that accepts MsgReplicateSync messages without further authentication is impacted. Upgrading to 26.06.1 or later removes the flaw.

The CVSS score of 8.3 indicates a high severity issue. Exploit probability data (EPSS) is not available, but the flaw is listed in no KEV catalog, suggesting it has not yet been widely leveraged. The attack vector is likely limited to peers that already have TLS/mTLS trust within the cluster, so an adversary must either compromise a legitimate cluster member or sit on the same network to inject messages. Once in the cluster network, the attacker could replay or tamper with data, and the lack of per‑message defenses means replay is also feasible. Given the high CVSS and the critical nature of telemetry data, the risk remains substantial.