Skip to content
OpenAdvisories

Vendor

getarcaneapp

13 known vulnerabilities.

Products

arcane 13
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 4.3
    CVE-2026-96628

    Arcane: Environment access token bypasses the admin-required authorization gate on `/api/debug/pprof`

    Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.11.0, AuthMiddleware.managerAuth accepts X-Arcane-Agent-Token credentials and the environment-token branch calls next before the AdminRequired option is evaluated…

    getarcaneapp arcane github.com/getarcaneapp/arcane/backend github.com/getarcaneapp/arcane/backend/v2 Go
  • Medium 6.5
    CVE-2026-86114

    Arcane before 2.0.0 Missing Administrator Authorization on the Compose Template Mutation Endpoints

    Arcane versions before 2.0.0 fail to properly restrict template operations, allowing default user role accounts to create, modify, and delete compose templates including instance-wide defaults. Attackers can inject malicious container configurations with priv…

    getarcaneapp arcane
  • Medium 6.3
    CVE-2026-45626

    Arcane: OS Command Injection in Volume Browser ListDirectory via path query parameter

    Arcane is an interface for managing Docker containers, images, networks, and volumes. In 1.18.1 and earlier, GET /environments/{id}/volumes/{volumeName}/browse accepts a path query parameter that is passed to a shell command (sh -c "find … | while …") inside …

    getarcaneapp arcane github.com/getarcaneapp/arcane/backend Go