Go/github.com/basekick-labs/arc CVE-2026-55678: medium 6.9, EPSS 0.66%

arc has unauthenticated cluster node admission when `cluster.shared_secret` is unset

Action: Upgrade github.com/basekick-labs/arc to 0.0.0-20260615160325-38402ad2ebdd or later.

go get github.com/basekick-labs/arc@v0.0.0-20260615160325-38402ad2ebdd

Affected

Fixed versions

Sources

• osv: GHSA-p378-jp5r-gpgw
• nvd: CVE-2026-55678
• https://github.com/Basekick-Labs/arc/security/advisories/GHSA-p378-jp5r-gpgw
• https://github.com/Basekick-Labs/arc/pull/505
• https://github.com/Basekick-Labs/arc/commit/38402ad2ebddd32c15bf4a0fc9c22c920e5685df
• https://github.com/Basekick-Labs/arc
• https://github.com/Basekick-Labs/arc/releases/tag/v26.06.2

CVE-2026-55678 · published 2026-08-28T20:32:57Z · modified 2026-09-02T19:55:38.727770329Z · JSON