CVE-2026-45625
CriticalCVSS 9.9Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
Arcane prior to version 1.19.0 has a vulnerability where eight REST API endpoints related to Git repositories lack admin role verification. This allows any logged-in user with the default user role to manage Git repository configurations and exfiltrate stored credentials (PATs, SSH keys) by repointing a repository to an attacker-controlled host.
Risk Assessment
The organization is at risk of leaking sensitive Git credentials (PATs, SSH keys) used for infrastructure management, potentially leading to unauthorized access to source code repositories and further attack escalation.
Recommendation
Immediately update Arcane to version 1.19.0 or later, which contains the fix for this vulnerability.
Other vulnerabilities in Arcane
See all- CVE-2026-86114Medium
Arcane versions before 2.0.0 fail to properly restrict template operations, allowing default user role accounts to create, modify, and delete compose templates including instance-wide defaults. Attackers can inject malicious container configurations with privileged settings or host path mounts that execute with administrative privileges when deployed by administrators.
- CVE-2026-47125High
Arcane, an interface for managing Docker containers, before version 1.19.2 contains a vulnerability due to missing admin authorization check on the PUT /api/environments/{id}/templates/variables endpoint. Any authenticated non-admin user can overwrite global environment variables used across all projects.
- CVE-2026-45626Medium
In Arcane 1.18.1 and earlier, the GET /environments/{id}/volumes/{volumeName}/browse endpoint accepts a path query parameter that is passed to a shell command (sh -c "find … | while …") inside an Arcane helper container. The path sanitizer blocks ../ traversal but does not strip Bourne-shell metacharacters such as $() or backticks, and strconv.Quote only escapes Go string metacharacters, not shell substitution sequences. Any authenticated user with access to a browseable volume can execute arbitrary commands inside the helper container; command output is reflected back in the 500 error body.
- CVE-2026-42461High
In Arcane prior to version 1.18.0, four GET endpoints under /api/templates* lack authentication, allowing unauthenticated clients to read the full Compose YAML and .env content of every template, including sensitive data such as database passwords and API keys.
- CVE-2025-69031Medium
The Arcane plugin for WordPress contains a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. The issue affects versions up to and including 3.6.6.
Original NVD description (English source)
Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 1.19.0, Arcane's huma-based REST API exposes nine endpoints under /api/customize/git-repositories and /api/git-repositories/sync for managing GitOps source repositories and their stored credentials. Eight of those endpoints (list, create, get, update, delete, test, listBranches, browseFiles) never call the checkAdmin(ctx) helper that every other admin-managed resource (container registries, environments, users, API keys, swarm, settings, system, notifications, events) uses, and the huma authentication middleware deliberately enforces only authentication, not the admin role. As a result, any logged-in user with the default user role can list, create, modify, delete, and test git repository configurations. By repointing an existing repository's URL to an attacker-controlled host while omitting the token/sshKey fields (which UpdateRepository only rewrites when explicitly supplied), the attacker causes Arcane to decrypt the legitimate PAT/SSH key on its next /test, /branches, or /files call and present it as HTTP Basic auth (or SSH key auth) to the attacker's host — producing a one-step exfiltration of plaintext Git credentials. This vulnerability is fixed in 1.19.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS