getarcaneapp has 6 CVEs on record. 4 were published in the last 90 days. The busiest recent month was October 2026 with 3. The median CVSS is 7.5 (high). None have a confirmed exploitation report. Most affected products: arcane (2), github.com/getarcaneapp/arcane/backend (2), github.com/getarcaneapp/arcane/backend/v2 (2).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.5
- Publish → KEV
- —
- Last 90 days
- 4 prev 1
Products
- arcane 2
- github.com/getarcaneapp/arcane/backend 2
- github.com/getarcaneapp/arcane/backend/v2 2
Worst active — by depth score
CVE-2026-40242High· 7.2Arcane has Unauthenticated SSRF with Conditional Response Reflection in Template Fetch Endpoint52CVE-2026-96627High· 8.8Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check)48CVE-2026-96626High· 8.5Arcane is an interface for managing Docker containers, images, networks, and volumes47CVE-2026-47179High· 7.7Arcane Has an Authenticated Arbitrary Host File Read via Docker Compose Include Directives42CVE-2026-86114Medium· 6.5Arcane versions before 2.0.0 fail to properly restrict template operations, allowing default user role accounts to create, modify, and delete compose templates including instance-wide defaults36
getarcaneapp vulnerabilities
CVEs affecting getarcaneapp, newest first. Open any entry for full detail, references, and exploit status.
6 CVEsRSS
CVE-2026-96626High· 8.5Arcane is an interface for managing Docker containers, images, networks, and volumes
Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.5.0, UpdateRegistry and TestRegistry in backend/api/services/container_registry_service.go allow the registry URL to change while preserving…
CVE-2026-96628Medium· 4.3Arcane: Environment access token bypasses the admin-required authorization gate on `/api/debug/pprof`
Arcane: Environment access token bypasses the admin-required authorization gate on `/api/debug/pprof`
CVE-2026-96627High· 8.8Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check)
Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check)
CVE-2026-86114Medium· 6.5Arcane versions before 2.0.0 fail to properly restrict template operations, allowing default user role accounts to create, modify, and delete compose templates including instance-wide defaults
Arcane versions before 2.0.0 fail to properly restrict template operations, allowing default user role accounts to create, modify, and delete compose templates including instance-wide defaults. Attackers can inject malicious container co…
CVE-2026-47179High· 7.7Arcane Has an Authenticated Arbitrary Host File Read via Docker Compose Include Directives
Arcane Has an Authenticated Arbitrary Host File Read via Docker Compose Include Directives
CVE-2026-40242High· 7.2PoCArcane has Unauthenticated SSRF with Conditional Response Reflection in Template Fetch Endpoint
Arcane has Unauthenticated SSRF with Conditional Response Reflection in Template Fetch Endpoint