Arc is an open, SQL‑native time‑series database. From version 26.02.1 through 26.06.2, the Enterprise clustering component allows nodes to join without authentication if the shared secret is left empty. An attacker can send a join request that passes only a cluster‑name check, creating an unauthorized node that the coordinator trusts. Once inside, the rogue node can be inserted as a Raft voter, receive forwarded requests with authentication headers, and manipulate cluster topology or intercept traffic.

Affected systems are Basekick‑Labs Arc installations where clustering is enabled (cluster.enabled = true) and the shared secret is unset. The default standalone configuration is safe because clustering is disabled. Versions up to and including 26.06.2 are vulnerable; the issue was fixed later in 26.06.2. Enterprise setups that rely on the default cluster name arc‑cluster are particularly susceptible.

The CVSS score of 6.9 indicates a moderate severity. Exploitation requires network access to the coordinator port, knowledge of the default cluster name, and that clustering is enabled with no shared secret. The EPSS score is unavailable, and the vulnerability is not listed in CISA KEV. Attackers can thus elevate privileges by inserting a rogue node, potentially exfiltrating data, hijacking queries, or disrupting cluster operation. Because authentication is omitted when the secret is empty, the attack is straightforward once the conditions are met.