Unauthorized Access Vulnerability in Arcane Product by Arcane

CVE-2026-23944

What is CVE-2026-23944?

The Arcane interface for managing Docker containers has a significant vulnerability that allows unauthenticated requests to be proxied to remote environment agents. This loophole exists in versions prior to 1.13.2, where the environment proxy middleware mishandles requests to remote environments. As a result, unauthorized users can exploit these requests to access and manipulate remote environment resources, such as listing containers or streaming logs, without needing proper authentication. This poses serious risks, including potential data exposure and unauthorized changes to services. The vulnerability has been addressed in version 1.13.2.

References