CVE-2026-42461
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
In Arcane prior to version 1.18.0, four GET endpoints under /api/templates* lack authentication, allowing unauthenticated clients to read the full Compose YAML and .env content of every template, including sensitive data such as database passwords and API keys.
Risk Assessment
An unauthenticated attacker can access sensitive data stored in templates, potentially leading to compromise of the entire infrastructure.
Recommendation
Update Arcane to version 1.18.0 or later, which includes the fix.
Other vulnerabilities in Arcane
See all- CVE-2026-45625Critical
Arcane prior to version 1.19.0 has a vulnerability where eight REST API endpoints related to Git repositories lack admin role verification. This allows any logged-in user with the default user role to manage Git repository configurations and exfiltrate stored credentials (PATs, SSH keys) by repointing a repository to an attacker-controlled host.
- CVE-2026-47125High
Arcane, an interface for managing Docker containers, before version 1.19.2 contains a vulnerability due to missing admin authorization check on the PUT /api/environments/{id}/templates/variables endpoint. Any authenticated non-admin user can overwrite global environment variables used across all projects.
- CVE-2026-45626Medium
In Arcane 1.18.1 and earlier, the GET /environments/{id}/volumes/{volumeName}/browse endpoint accepts a path query parameter that is passed to a shell command (sh -c "find … | while …") inside an Arcane helper container. The path sanitizer blocks ../ traversal but does not strip Bourne-shell metacharacters such as $() or backticks, and strconv.Quote only escapes Go string metacharacters, not shell substitution sequences. Any authenticated user with access to a browseable volume can execute arbitrary commands inside the helper container; command output is reflected back in the 500 error body.
Original NVD description (English source)
Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to version 1.18.0, four GET endpoints under /api/templates* in Arcane's Huma backend are registered without any Security requirement, allowing any unauthenticated network client to list and read the full Compose YAML and .env content of every custom template stored in the instance. Because Arcane's UI exposes a "Save as Template" flow on the project / swarm-stack creation pages that persists the operator's real env content (database passwords, API keys, etc.) verbatim, this missing authorization is an unauthenticated read of operator secrets in practice — not a theoretical info-disclosure. The frontend explicitly treats /customize/templates/* as an authenticated area (PROTECTED_PREFIXES in frontend/src/lib/utils/redirect.util.ts), and every CRUD operation (POST/PUT/DELETE) on the same paths requires a Bearer/API key, so this is a clear backend authorization gap, not intended public access. This issue has been patched in version 1.18.0.