Vulnerabilities

TI-2026-75557 CVE-2026-96627 · GHSA-pw5q-rjx4-7f7p

Arcane users with delegated permission can take over admin accounts

MEDIUM 40

Arcane is an interface for managing Docker containers, images, networks, and volumes.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00368 Published 2026-10-16 Fixed in 2.6.0 CWE-266

TI-2026-75558 CVE-2026-96628 · GHSA-mp22-58ff-6fhr

Arcane environment token bypasses admin check on pprof endpoint

LOW 19

Arcane is an interface for managing Docker containers, images, networks, and volumes.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00204 Published 2026-10-16 Fixed in 2.11.0 CWE-863

TI-2026-75556 CVE-2026-96626

Credential exfiltration in Arcane via registry URL repointing

LOW 36

Arcane is an interface for managing Docker containers, images, networks, and volumes.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00216 Published 2026-10-16 Fixed in 2.5.0 CWE-200

TI-2026-58913 CVE-2026-86114 · GHSA-pj2x-fr4j-wrxq

Arcane before 2.0.0 Missing Administrator Authorization on the Compose Template Mutation Endpoints

LOW 32

Arcane versions before 2.0.0 fail to properly restrict template operations, allowing default user role accounts to create, modify, and delete compose templates including instance-wide defaults.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.0043 Published 2026-09-05 Fixed in 2.0.0 CWE-862

TI-2026-33369 CVE-2026-45625 · GHSA-7h26-hg47-p9hx

Missing authorization in getarcaneapp arcane

MEDIUM 43

Arcane is an interface for managing Docker containers, images, networks, and volumes.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00387 Published 2026-05-29 Fixed in 1.19.0 CWE-862

TI-2026-33370 CVE-2026-45626 · GHSA-9mvm-4gwg-v8mp

Arcane: OS Command Injection in Volume Browser ListDirectory via path query parameter

LOW 27

Arcane is an interface for managing Docker containers, images, networks, and volumes.

CVSS 3.1MEDIUM 6.3 Network Low privileges No interaction EPSS 0.0021 Published 2026-05-29 No fix listed CWE-78

TI-2026-33371 CVE-2026-45627 · GHSA-q2pj-8v84-9mh5

Arcane: Unauthenticated reflected XSS via SVG color parameter in /api/app-images/logo enables admin account takeover

LOW 35

Arcane is an interface for managing Docker containers, images, networks, and volumes.

CVSS 3.1HIGH 8.2 Network No auth User interaction EPSS 0.00185 Published 2026-05-29 Fixed in 1.19.0 CWE-79

TI-2026-34717 CVE-2026-47125 · GHSA-jpjh-jm2p-39hh

Arcane: Missing admin authorization on global variables endpoint

MEDIUM 40

Arcane is an interface for managing Docker containers, images, networks, and volumes.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00245 Published 2026-05-29 Fixed in 1.19.2 CWE-862

TI-2026-34768 CVE-2026-47179 · GHSA-c3px-h233-h6fq

Arcane: Authenticated Arbitrary Host File Read via Docker Compose Include Directives in Arcane

LOW 33

Arcane is an interface for managing Docker containers, images, networks, and volumes.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00307 Published 2026-05-29 Fixed in 1.19.4 CWE-22

Vulnerabilities

Filters