Admin Authorization Bypass in Arcane for Docker Management

CVE-2026-47125

What is CVE-2026-47125?

The Arcane interface for Docker management has a vulnerability in its API endpoint, allowing authenticated non-admin users to update critical global environment variables. This oversight permits an attacker to manipulate essential configurations, leading to potential disruptions in project deployments or unauthorized data access. The flaw, which was rectified in version 1.19.2, could allow attackers to redirect Docker image pulls to malicious registries, compromising the integrity of software supply chains and risking exposure of sensitive data such as database credentials.

References