Read the docs
TI-2026-34717 Aliases CVE-2026-47125GHSA-jpjh-jm2p-39hh

Arcane: Missing admin authorization on global variables endpoint

Priority MEDIUM 40CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-862.

Summary

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 1.19.2, the PUT /api/environments/{id}/templates/variables endpoint, which writes the system-wide .env.global file used for variable substitution in every project's compose file, is missing an admin authorization check. Any authenticated non-admin user can call this endpoint with their bearer token or API key and overwrite the global environment variables that are merged into every project deployment. By overriding values like REGISTRY, IMAGE, DATABASE_URL, or SECRET_KEY that other users reference via ${VAR} in compose files, an attacker can redirect image pulls to attacker-controlled registries (supply-chain RCE on the Docker host), exfiltrate database credentials, or disrupt all projects. This vulnerability is fixed in 1.19.2.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00245 15th percentileScored 2026-11-07
Fix Fixed arcane (getarcaneapp): 1.19.2github.com/getarcaneapp/arcane/backend (Go): 1.19.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
getarcaneapparcanebefore 1.19.21.19.2Patch availableCNA
—github.com/getarcaneapp/arcane/backend (Go)before 1.19.21.19.2Patch availableGHSA-jpjh-jm2p-39hh
  • arcane Vendorgetarcaneapp Affected before 1.19.2 Fixed in 1.19.2 Patch available CNA
  • github.com/getarcaneapp/arcane/backend (Go) Vendor— Affected before 1.19.2 Fixed in 1.19.2 Patch available GHSA-jpjh-jm2p-39hh

Remediation

  • Fix · CNA arcane (getarcaneapp) Fixed in 1.19.2
  • Fix · GHSA-jpjh-jm2p-39hh github.com/getarcaneapp/arcane/backend (Go) Fixed in 1.19.2 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-47125
  2. 2026-10-03 Alias added: GHSA-jpjh-jm2p-39hh

References

Advisory 1

Other 2

  • TI-2026-33369 Missing authorization in getarcaneapp arcane CVSS 3.1CRITICAL 9.9
  • TI-2026-75557 Arcane users with delegated permission can take over admin accounts CVSS 3.1HIGH 8.8
  • TI-2026-75556 Credential exfiltration in Arcane via registry URL repointing CVSS 3.1HIGH 8.5
  • TI-2026-33371 Arcane: Unauthenticated reflected XSS via SVG color parameter in /api/app-images/logo enables admin account takeover CVSS 3.1HIGH 8.2
  • TI-2026-34768 Arcane: Authenticated Arbitrary Host File Read via Docker Compose Include Directives in Arcane CVSS 3.1HIGH 7.7
  • TI-2026-58913 Arcane before 2.0.0 Missing Administrator Authorization on the Compose Template Mutation Endpoints CVSS 4.0HIGH 7.1
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences