CVE-2026-86114highCWE-862

CVE-2026-86114: high-severity vulnerability in getarcaneapp arcane

Arcane before 2.0.0 Missing Administrator Authorization on the Compose Template Mutation Endpoints

Published · Updated

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.1epss 0.4%
exploitation probability
0.4%top 63% of all CVEs
observed exploitation
nono source reports it
Arcane versions before 2.0.0 fail to properly restrict template operations, allowing default user role accounts to create, modify, and delete compose templates including instance-wide defaults. Attackers can inject malicious container configurations with privileged settings or host path mounts that execute with administrative privileges when deployed by administrators.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Affected products
getarcaneapp · arcane
Related CVEs — getarcaneapp arcane

In the same product, most dangerous first.

CVE-2026-23520CRITICALArcane has a Command Injection in Arcane Updater Lifecycle Labels Enables RCEEPSS 1.8%CVE-2026-42461HIGHArcane Vulnerable to Unauthenticated Disclosure of Custom Compose Template Content (incl. `.env` secrets)EPSS 1.3%CVE-2026-40242HIGHArcane Unauthenticated SSRF with Conditional Response Reflection in Template Fetch EndpointEPSS 0.6%CVE-2026-23944HIGHArcane allows unauthenticated proxy access to remote environmentsEPSS 0.5%CVE-2026-45625CRITICALArcane: Missing admin authorization on git repository endpoints allows non-admin users to exfiltrate stored Git credentials and tamper with GitOps configsEPSS 0.4%CVE-2026-47179HIGHArcane: Authenticated Arbitrary Host File Read via Docker Compose Include Directives in ArcaneEPSS 0.3%
References
https://github.com/geo-chen/oss/blob/main/arcane.mdhttps://github.com/getarcaneapp/arcanehttps://github.com/getarcaneapp/arcane/blob/v1.19.5/backend/api/handlers/templates.gohttps://github.com/getarcaneapp/arcane/commit/1500646aa91fhttps://github.com/getarcaneapp/arcane/releases/tag/v2.0.0https://www.vulncheck.com/advisories/arcane-before-2.0.0-missing-administrator-authorization-on-the-compose-template-mutation-endpoints