getarcaneapp arcane vulnerabilities

Newest CVEs

• CVE-2026-96627

  Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check)

  getarcaneapp · arcane

  High8.8
• CVE-2026-96628

  Arcane: Environment access token bypasses the admin-required authorization gate on `/api/debug/pprof`

  getarcaneapp · arcane

  Medium4.3
• CVE-2026-96626

  Arcane: Container-registry credential exfiltration via URL repoint + test to attacker host

  getarcaneapp · arcane

  High8.5
• CVE-2026-86114

  Arcane before 2.0.0 Missing Administrator Authorization on the Compose Template Mutation Endpoints

  getarcaneapp · arcane

  High7.1
• CVE-2026-45625

  Arcane: Missing admin authorization on git repository endpoints allows non-admin users to exfiltrate stored Git credentials and tamper with GitOps configs

  getarcaneapp · arcane

  Critical9.9
• CVE-2026-45626

  Arcane: OS Command Injection in Volume Browser ListDirectory via path query parameter

  getarcaneapp · arcane

  Medium6.3
• CVE-2026-45627

  Arcane: Unauthenticated reflected XSS via SVG color parameter in /api/app-images/logo enables admin account takeover

  getarcaneapp · arcane

  High8.2
• CVE-2026-47125

  Arcane: Missing admin authorization on global variables endpoint

  getarcaneapp · arcane

  High8.8
• CVE-2026-47179

  Arcane: Authenticated Arbitrary Host File Read via Docker Compose Include Directives in Arcane

  getarcaneapp · arcane

  High7.7
• CVE-2026-42461

  Arcane Vulnerable to Unauthenticated Disclosure of Custom Compose Template Content (incl. `.env` secrets)

  getarcaneapp · arcane

  High8.7