CVE-2026-86114: falha de alta gravidade em getarcaneapp arcane
Arcane before 2.0.0 Missing Administrator Authorization on the Compose Template Mutation Endpoints
Publicada em · Atualizada em
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.1epss 0.4%
probabilidade de exploração
0.4%top 63% das CVEs
exploração observada
nãonenhuma fonte reporta
Arcane versions before 2.0.0 fail to properly restrict template operations, allowing default user role accounts to create, modify, and delete compose templates including instance-wide defaults. Attackers can inject malicious container configurations with privileged settings or host path mounts that execute with administrative privileges when deployed by administrators.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Produtos afetados
getarcaneapp · arcaneCVEs relacionadas — getarcaneapp arcane
No mesmo produto, das mais perigosas para as menos.
CVE-2026-23520CRITICALArcane has a Command Injection in Arcane Updater Lifecycle Labels Enables RCEEPSS 1.8%CVE-2026-42461HIGHArcane Vulnerable to Unauthenticated Disclosure of Custom Compose Template Content (incl. `.env` secrets)EPSS 1.3%CVE-2026-40242HIGHArcane Unauthenticated SSRF with Conditional Response Reflection in Template Fetch EndpointEPSS 0.6%CVE-2026-23944HIGHArcane allows unauthenticated proxy access to remote environmentsEPSS 0.5%CVE-2026-45625CRITICALArcane: Missing admin authorization on git repository endpoints allows non-admin users to exfiltrate stored Git credentials and tamper with GitOps configsEPSS 0.4%CVE-2026-47179HIGHArcane: Authenticated Arbitrary Host File Read via Docker Compose Include Directives in ArcaneEPSS 0.3%
Referências
https://github.com/geo-chen/oss/blob/main/arcane.mdhttps://github.com/getarcaneapp/arcanehttps://github.com/getarcaneapp/arcane/blob/v1.19.5/backend/api/handlers/templates.gohttps://github.com/getarcaneapp/arcane/commit/1500646aa91fhttps://github.com/getarcaneapp/arcane/releases/tag/v2.0.0https://www.vulncheck.com/advisories/arcane-before-2.0.0-missing-administrator-authorization-on-the-compose-template-mutation-endpoints