CVE-2026-40242: Arcane Docker Manager SSRF Vulnerability

CVE-2026-40242 Overview

CVE-2026-40242 is a Server-Side Request Forgery (SSRF) vulnerability affecting Arcane, a web-based interface for managing Docker containers, images, networks, and volumes. The vulnerability exists in the /api/templates/fetch endpoint, which accepts a user-supplied url parameter and performs a server-side HTTP GET request without proper validation. This allows unauthenticated attackers to make arbitrary HTTP requests from the server, potentially accessing internal services, cloud metadata endpoints, or other protected resources.

Critical Impact

Unauthenticated attackers can exploit this SSRF vulnerability to access internal network resources, cloud metadata services, and potentially pivot to other systems from any publicly reachable Arcane instance.

Affected Products

• Arcane versions prior to 1.17.3

Discovery Timeline

• 2026-04-10 - CVE CVE-2026-40242 published to NVD
• 2026-04-13 - Last updated in NVD database

Technical Details for CVE-2026-40242

Vulnerability Analysis

This SSRF vulnerability (CWE-918) allows attackers to abuse the Arcane server as a proxy to make HTTP requests to arbitrary destinations. The /api/templates/fetch endpoint is designed to fetch template data from remote sources but fails to implement critical security controls. The endpoint does not require authentication, making it accessible to any user who can reach the Arcane instance. Additionally, there is no validation of the URL scheme (allowing file://, gopher://, or other dangerous protocols) or host (permitting requests to internal IP ranges like 127.0.0.1, 10.x.x.x, or cloud metadata endpoints like 169.254.169.254).

The server's response from the target URL is returned directly to the attacker, enabling information disclosure from internal resources that would otherwise be inaccessible from external networks.

Root Cause

The root cause is inadequate input validation in the /api/templates/fetch endpoint. The endpoint accepts a caller-supplied url parameter and directly uses it to perform a server-side HTTP GET request without:

1. Validating the URL scheme to restrict to safe protocols (e.g., http:// or https://)
2. Validating the target host to prevent requests to internal IP ranges or localhost
3. Implementing authentication to restrict access to authorized users
4. Sanitizing or filtering the response before returning it to the caller

Attack Vector

This vulnerability is exploited via network access with no authentication required. An attacker can craft a malicious request to the /api/templates/fetch endpoint, specifying an internal URL as the url parameter. Common attack scenarios include:

• Accessing cloud provider metadata endpoints (e.g., AWS http://169.254.169.254/latest/meta-data/) to steal credentials
• Scanning internal network services to map the infrastructure
• Accessing internal APIs or administrative interfaces
• Reading local files if file:// protocol is supported
• Interacting with internal databases or caches (Redis, Memcached) via HTTP or protocol smuggling

The vulnerability requires no user interaction and can be exploited against any publicly accessible Arcane instance.

Detection Methods for CVE-2026-40242

Indicators of Compromise

• Unusual outbound HTTP requests from the Arcane server to internal IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.1)
• HTTP requests to cloud metadata endpoints (169.254.169.254) originating from the Arcane server
• Access logs showing requests to /api/templates/fetch with suspicious URL parameters containing internal addresses or non-HTTP protocols

Detection Strategies

• Monitor web server access logs for requests to /api/templates/fetch with url parameters pointing to internal IP addresses or sensitive endpoints
• Implement network monitoring to detect outbound connections from the Arcane server to unexpected internal destinations
• Deploy Web Application Firewall (WAF) rules to detect and block SSRF patterns in the url parameter

Monitoring Recommendations

• Enable detailed logging for the /api/templates/fetch endpoint to capture all url parameter values
• Configure network egress monitoring on the Arcane server to alert on connections to RFC1918 addresses or cloud metadata services
• Set up alerts for high volumes of requests to the vulnerable endpoint from single source IPs

How to Mitigate CVE-2026-40242

Immediate Actions Required

• Upgrade Arcane to version 1.17.3 or later immediately
• If immediate upgrade is not possible, restrict network access to the Arcane instance using firewall rules
• Block outbound access from the Arcane server to sensitive internal networks and cloud metadata endpoints
• Review access logs for signs of previous exploitation

Patch Information

The vulnerability is fixed in Arcane version 1.17.3. The patch addresses the SSRF vulnerability by implementing proper URL validation and authentication controls on the /api/templates/fetch endpoint. For more details, see the GitHub Release v1.17.3 and the GitHub Security Advisory GHSA-ff24-4prj-gpmj.

Workarounds

• Restrict network access to the Arcane instance to trusted IP addresses only using firewall rules or reverse proxy access controls
• Implement a Web Application Firewall (WAF) rule to block requests to /api/templates/fetch with url parameters containing internal IP addresses or non-HTTPS schemes
• If the templates feature is not required, consider blocking the /api/templates/fetch endpoint entirely at the reverse proxy level

# Example nginx configuration to block the vulnerable endpoint
location /api/templates/fetch {
    deny all;
    return 403;
}