CVE-2026-40242: fallo de gravedad alta en getarcaneapp arcane
Arcane Unauthenticated SSRF with Conditional Response Reflection in Template Fetch Endpoint
Publicada el · Actualizada el
58Vexday Risk Score
Corrige ahora. Ella explotación observada por VulnCheck y tiene exploit funcional público.
ssvc Actcvss 7.2epss 0.6%
de la publicación al arma
Publicada en NVD10 abr
VulnCheck+160d
probabilidad de explotación
0.6%top 50% de las CVE
explotación observada
síVulnCheck
Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 1.17.3, the /api/templates/fetch endpoint accepts a caller-supplied url parameter and performs a server-side HTTP GET request to that URL without authentication and without URL scheme or host validation. The server's response is returned directly to the caller. type. This constitutes an unauthenticated SSRF vulnerability affecting any publicly reachable Arcane instance. This vulnerability is fixed in 1.17.3.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Productos afectados
getarcaneapp · arcaneCVEs relacionadas — getarcaneapp arcane
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-23520CRITICALArcane has a Command Injection in Arcane Updater Lifecycle Labels Enables RCEEPSS 1.8%CVE-2026-42461HIGHArcane Vulnerable to Unauthenticated Disclosure of Custom Compose Template Content (incl. `.env` secrets)EPSS 1.3%CVE-2026-23944HIGHArcane allows unauthenticated proxy access to remote environmentsEPSS 0.5%CVE-2026-86114HIGHArcane before 2.0.0 Missing Administrator Authorization on the Compose Template Mutation EndpointsEPSS 0.4%CVE-2026-45625CRITICALArcane: Missing admin authorization on git repository endpoints allows non-admin users to exfiltrate stored Git credentials and tamper with GitOps configsEPSS 0.4%CVE-2026-47179HIGHArcane: Authenticated Arbitrary Host File Read via Docker Compose Include Directives in ArcaneEPSS 0.3%