Read the docs
TI-2026-18944 Aliases CVE-2026-23520GHSA-gjqq-6r35-w3r8

Arcane has a Command Injection in Arcane Updater Lifecycle Labels Enables RCE

Priority MEDIUM 45CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-78.

Summary

Arcane provides modern docker management. Prior to 1.13.0, Arcane has a command injection in the updater service. Arcane’s updater service supported lifecycle labels com.getarcaneapp.arcane.lifecycle.pre-update and com.getarcaneapp.arcane.lifecycle.post-update that allowed defining a command to run before or after a container update. The label value is passed directly to /bin/sh -c without sanitization or validation. Because any authenticated user (not limited to administrators) can create projects through the API, an attacker can create a project that specifies one of these lifecycle labels with a malicious command. When an administrator later triggers a container update (either manually or via scheduled update checks), Arcane reads the lifecycle label and executes its value as a shell command inside the container. This vulnerability is fixed in 1.13.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01846 79th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed arcane (getarcaneapp): 1.13.0github.com/getarcaneapp/arcane/backend (Go): 0.0.0-20260114065515-5a9c2f92e11f

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
getarcaneapparcanebefore 1.13.01.13.0Patch availableCNA
—github.com/getarcaneapp/arcane/backend (Go)before 0.0.0-20260114065515-5a9c2f92e11f0.0.0-20260114065515-5a9c2f92e11fPatch availableGHSA-gjqq-6r35-w3r8
  • arcane Vendorgetarcaneapp Affected before 1.13.0 Fixed in 1.13.0 Patch available CNA
  • github.com/getarcaneapp/arcane/backend (Go) Vendor— Affected before 0.0.0-20260114065515-5a9c2f92e11f Fixed in 0.0.0-20260114065515-5a9c2f92e11f Patch available GHSA-gjqq-6r35-w3r8

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:arcane:arcane:*:*:*:*:*:*:*:*before 1.13.0VulnerableArcane
  • cpe:2.3:a:arcane:arcane:*:*:*:*:*:*:*:* Versions before 1.13.0 Vulnerable ·Arcane

Remediation

  • Fix · CNA arcane (getarcaneapp) Fixed in 1.13.0
  • Fix · GHSA-gjqq-6r35-w3r8 github.com/getarcaneapp/arcane/backend (Go) Fixed in 0.0.0-20260114065515-5a9c2f92e11f Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-23520
  2. 2026-10-03 Alias added: GHSA-gjqq-6r35-w3r8

References

Exploit 1

Advisory 2

Other 3

  • TI-2026-33369 Missing authorization in getarcaneapp arcane CVSS 3.1CRITICAL 9.9
  • TI-2026-75557 Arcane users with delegated permission can take over admin accounts CVSS 3.1HIGH 8.8
  • TI-2026-34717 Arcane: Missing admin authorization on global variables endpoint CVSS 3.1HIGH 8.8
  • TI-2026-75556 Credential exfiltration in Arcane via registry URL repointing CVSS 3.1HIGH 8.5
  • TI-2026-33371 Arcane: Unauthenticated reflected XSS via SVG color parameter in /api/app-images/logo enables admin account takeover CVSS 3.1HIGH 8.2
  • TI-2026-34768 Arcane: Authenticated Arbitrary Host File Read via Docker Compose Include Directives in Arcane CVSS 3.1HIGH 7.7
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences