What is CVE-2026-55678?

CVE-2026-55678 is a medium-severity improper authentication vulnerability in github.com/basekick-labs/arc (go), affecting versions < 0.0.0-20260615160325-38402ad2ebdd. It is fixed in 0.0.0-20260615160325-38402ad2ebdd. The application does not adequately verify the identity of a user, device, or process before granting access.

Which versions of github.com/basekick-labs/arc are affected by CVE-2026-55678?

github.com/basekick-labs/arc (go) versions < 0.0.0-20260615160325-38402ad2ebdd is affected.

Is there a fix for CVE-2026-55678?

Yes. CVE-2026-55678 is fixed in 0.0.0-20260615160325-38402ad2ebdd. Upgrade to this version or later.

Is CVE-2026-55678 exploitable, and should I be worried?

Whether CVE-2026-55678 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk.

What actually determines whether CVE-2026-55678 is exploitable, and how bad it is?

Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.

How do I fix CVE-2026-55678?

Upgrade github.com/basekick-labs/arc to 0.0.0-20260615160325-38402ad2ebdd or later.

CVE-2026-55678 in github.com/basekick-labs/arc

Q: Which versions of github.com/basekick-labs/arc are affected by CVE-2026-55678?

github.com/basekick-labs/arc (go) versions < 0.0.0-20260615160325-38402ad2ebdd is affected.

Q: Is there a fix for CVE-2026-55678?

Yes. CVE-2026-55678 is fixed in 0.0.0-20260615160325-38402ad2ebdd. Upgrade to this version or later.

Q: Is CVE-2026-55678 exploitable, and should I be worried?

Whether CVE-2026-55678 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk.

Q: What actually determines whether CVE-2026-55678 is exploitable, and how bad it is?

Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.

Q: How do I fix CVE-2026-55678?

Upgrade github.com/basekick-labs/arc to 0.0.0-20260615160325-38402ad2ebdd or later.

Summary

arc has unauthenticated cluster node admission when cluster.shared_secret is unset

Impact

In affected cluster deployments, an unauthenticated network attacker can become a trusted cluster node. Practical impacts include:

Interception of forwarded authenticated HTTP requests, including Authorization and x-api-key headers.
Exposure of query bodies, ingestion data, database/measurement names, and operational metadata.
Unauthorized cluster membership mutation, including attempted Raft voter addition when Raft is configured.
Potential data integrity impact if the rogue node returns forged query/write responses or accepts/diverts writes.
Potential availability impact by blackholing or delaying forwarded operations.

This is not reachable in the default standalone configuration because cluster.enabled=false, but it is a critical trust-boundary issue for Enterprise cluster deployments where clustering is enabled without a shared secret. The code already treats cluster.shared_secret as mandatory for replication, which suggests unauthenticated cluster membership should also fail closed.

The application does not adequately verify the identity of a user, device, or process before granting access. Typical impact: unauthorized access to functions or data reserved for authenticated parties.

Affected versions

github.com/basekick-labs/arc (< 0.0.0-20260615160325-38402ad2ebdd)

Security releases

github.com/basekick-labs/arc → 0.0.0-20260615160325-38402ad2ebdd (go)

Kodem intelligence

Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.

Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.

Already deployed Kodem?

See it in your environment New to Kodem? Get a demo →

Remediation advice

Fail startup when cluster.enabled=true and cluster.shared_secret is empty, not only when cluster.replication_enabled=true.
Reject all trust-mutating coordinator messages when no cluster authentication is configured, including join, heartbeat/state update, forward apply, and file replication messages.
Require HMAC or mutual TLS before processing any join/heartbeat message.
Bind authentication to node identity and advertised addresses to reduce replay and address-substitution risks.
Do not forward end-user Authorization/x-api-key headers to a peer unless the peer identity has been authenticated and authorized.
Add tests proving unauthenticated join and heartbeat requests fail when clustering is enabled.

Frequently Asked Questions

What is CVE-2026-55678? CVE-2026-55678 is a medium-severity improper authentication vulnerability in github.com/basekick-labs/arc (go), affecting versions < 0.0.0-20260615160325-38402ad2ebdd. It is fixed in 0.0.0-20260615160325-38402ad2ebdd. The application does not adequately verify the identity of a user, device, or process before granting access.
Which versions of github.com/basekick-labs/arc are affected by CVE-2026-55678? github.com/basekick-labs/arc (go) versions < 0.0.0-20260615160325-38402ad2ebdd is affected.
Is there a fix for CVE-2026-55678? Yes. CVE-2026-55678 is fixed in 0.0.0-20260615160325-38402ad2ebdd. Upgrade to this version or later.
Is CVE-2026-55678 exploitable, and should I be worried? Whether CVE-2026-55678 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
What actually determines whether CVE-2026-55678 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
How do I fix CVE-2026-55678? Upgrade github.com/basekick-labs/arc to 0.0.0-20260615160325-38402ad2ebdd or later.