getarcaneapp/arcane Security Advisories | GitStock

high2026-10-16

Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check)

GHSA-pw5q-rjx4-7f7p · CVE-2026-96627

medium2026-10-16

Arcane: Environment access token bypasses the admin-required authorization gate on `/api/debug/pprof`

GHSA-mp22-58ff-6fhr · CVE-2026-96628

high2026-05-28

Arcane Has an Authenticated Arbitrary Host File Read via Docker Compose Include Directives

GHSA-c3px-h233-h6fq · CVE-2026-47179

high2026-05-23

Arcane: Missing admin authorization on global variables endpoint

GHSA-jpjh-jm2p-39hh · CVE-2026-47125

high2026-05-18

Arcane Backend: Unauthenticated reflected XSS via SVG color parameter enables admin account takeover

GHSA-q2pj-8v84-9mh5 · CVE-2026-45627

medium2026-05-18

Arcane Backend: OS Command Injection in Volume Browser ListDirectory via path query parameter

GHSA-9mvm-4gwg-v8mp · CVE-2026-45626

critical2026-05-18

Arcane Backend: Missing admin authorization on git repository endpoints allows non-admin users to exfiltrate stored Git credentials and tamper with GitOps configs

GHSA-7h26-hg47-p9hx · CVE-2026-45625

high2026-04-30

Arcane Vulnerable to Unauthenticated Disclosure of Custom Compose Template Content (incl. `.env` secrets)

GHSA-cxx3-hr75-4q96 · CVE-2026-42461

high2026-04-10

Arcane has Unauthenticated SSRF with Conditional Response Reflection in Template Fetch Endpoint

GHSA-ff24-4prj-gpmj · CVE-2026-40242

critical2026-01-15

Arcane Has a Command Injection in Arcane Updater Lifecycle Labels That Enables RCE

GHSA-gjqq-6r35-w3r8 · CVE-2026-23520