Server-Side Request Forgery in Arcane Docker Management Interface

CVE-2026-40242

What is CVE-2026-40242?

The Arcane interface, utilized for managing Docker containers, images, networks, and volumes, is susceptible to a server-side request forgery (SSRF) vulnerability. Specifically, prior to version 1.17.3, the /api/templates/fetch endpoint permits the submission of a user-defined URL, which is subsequently accessed via a server-side HTTP GET request. This initiation occurs without the necessary authentication and lacks validation for the URL scheme or host. The server's response is then forwarded directly to the originating caller. Such a design flaw exposes any public-facing instance of Arcane to potential exploitation via SSRF attacks, allowing malicious actors to leverage the server's privileges to interact with internal resources without authorization.

References