Skip to content
OpenAdvisories

Package · Go

github.com/getarcaneapp/arcane/backend

10 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 4.3
    CVE-2026-96628

    Arcane: Environment access token bypasses the admin-required authorization gate on `/api/debug/pprof`

    Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.11.0, AuthMiddleware.managerAuth accepts X-Arcane-Agent-Token credentials and the environment-token branch calls next before the AdminRequired option is evaluated…

    getarcaneapp arcane github.com/getarcaneapp/arcane/backend github.com/getarcaneapp/arcane/backend/v2 Go
  • Medium 6.3
    CVE-2026-45626

    Arcane: OS Command Injection in Volume Browser ListDirectory via path query parameter

    Arcane is an interface for managing Docker containers, images, networks, and volumes. In 1.18.1 and earlier, GET /environments/{id}/volumes/{volumeName}/browse accepts a path query parameter that is passed to a shell command (sh -c "find … | while …") inside …

    getarcaneapp arcane github.com/getarcaneapp/arcane/backend Go