Unauthorized Access in Arcane Backend for Docker Management
CVE-2026-42461

8.7HIGH

Key Information:

Vendor

Getarcaneapp

Status
Arcane
Vendor
CVE Published:
9 May 2026

What is CVE-2026-42461?

Arcane, a management tool for Docker containers, previously had a significant security flaw allowing unauthenticated access to sensitive information. Four GET endpoints in the Huma backend were improperly secured, enabling any network client to retrieve full Compose YAML and environment variable content stored in templates. This flaw directly impacted operators by leaking critical secrets, such as database passwords and API keys, stored in the project templates. While the frontend of Arcane required authentication for data manipulation, the backend endpoint exposure represented a clear gap in authorization policies. This vulnerability has been rectified in version 1.18.0 of the software.

Affected Version(s)

arcane < 1.18.0

References

https://github.com/getarcaneapp/arcane/security/advisorie...
x_refsource_CONFIRM
https://github.com/getarcaneapp/arcane/releases/tag/v1.18.0
x_refsource_MISC

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.