CVE-2026-86114highCWE-862

CVE-2026-86114: fallo de gravedad alta en getarcaneapp arcane

Arcane before 2.0.0 Missing Administrator Authorization on the Compose Template Mutation Endpoints

Publicada el · Actualizada el

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 7.1epss 0.4%
probabilidad de explotación
0.4%top 63% de las CVE
explotación observada
noninguna fuente lo reporta
Arcane versions before 2.0.0 fail to properly restrict template operations, allowing default user role accounts to create, modify, and delete compose templates including instance-wide defaults. Attackers can inject malicious container configurations with privileged settings or host path mounts that execute with administrative privileges when deployed by administrators.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Productos afectados
getarcaneapp · arcane
CVEs relacionadas — getarcaneapp arcane

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-23520CRITICALArcane has a Command Injection in Arcane Updater Lifecycle Labels Enables RCEEPSS 1.8%CVE-2026-42461HIGHArcane Vulnerable to Unauthenticated Disclosure of Custom Compose Template Content (incl. `.env` secrets)EPSS 1.3%CVE-2026-40242HIGHArcane Unauthenticated SSRF with Conditional Response Reflection in Template Fetch EndpointEPSS 0.6%CVE-2026-23944HIGHArcane allows unauthenticated proxy access to remote environmentsEPSS 0.5%CVE-2026-45625CRITICALArcane: Missing admin authorization on git repository endpoints allows non-admin users to exfiltrate stored Git credentials and tamper with GitOps configsEPSS 0.4%CVE-2026-47179HIGHArcane: Authenticated Arbitrary Host File Read via Docker Compose Include Directives in ArcaneEPSS 0.3%
Referencias
https://github.com/geo-chen/oss/blob/main/arcane.mdhttps://github.com/getarcaneapp/arcanehttps://github.com/getarcaneapp/arcane/blob/v1.19.5/backend/api/handlers/templates.gohttps://github.com/getarcaneapp/arcane/commit/1500646aa91fhttps://github.com/getarcaneapp/arcane/releases/tag/v2.0.0https://www.vulncheck.com/advisories/arcane-before-2.0.0-missing-administrator-authorization-on-the-compose-template-mutation-endpoints