CVE-2026-42461: Getarcane Arcane Information Disclosure

CVE-2026-42461 Overview

CVE-2026-42461 is a missing authorization vulnerability [CWE-862] in Arcane, an interface for managing Docker containers, images, networks, and volumes. Four GET endpoints under /api/templates* in Arcane's Huma backend are registered without any security requirement. Unauthenticated network clients can list and read the full Compose YAML and .env content of every custom template stored in the instance. Because Arcane's UI exposes a Save as Template flow that persists operator secrets verbatim, this gap exposes database passwords and API keys in practice. The issue affects versions prior to 1.18.0 and is patched in 1.18.0.

Critical Impact
Unauthenticated remote attackers can read operator secrets, including database passwords and API keys, stored within custom templates.

Affected Products

Getarcane Arcane versions prior to 1.18.0
Arcane Huma backend /api/templates* GET endpoints
Self-hosted Arcane Docker management instances reachable over the network

Discovery Timeline

2026-05-09 - CVE-2026-42461 published to NVD
2026-05-15 - Last updated in NVD database

Technical Details for CVE-2026-42461

Vulnerability Analysis

Arcane's frontend treats /customize/templates/* as an authenticated area via PROTECTED_PREFIXES in frontend/src/lib/utils/redirect.util.ts. Every CRUD operation using POST, PUT, or DELETE on the same template paths requires a Bearer token or API key. The four GET endpoints under /api/templates* in the Huma backend, however, were registered without a Security requirement. This asymmetry between read and write authorization defines the vulnerability. Attackers can enumerate and download stored templates without credentials, including the embedded operator .env content.

Root Cause

The Huma backend route registrations for the template GET handlers omitted the Security requirement that the matching write endpoints declare. Authorization middleware is therefore never invoked on inbound read requests. The frontend assumes the backend enforces protection on these routes, but no server-side check exists. This is a backend authorization gap, not intended public access.

Attack Vector

A remote attacker who can reach the Arcane HTTP interface issues unauthenticated GET requests against the template endpoints under /api/templates*. The server returns Compose YAML and .env content for every custom template stored on the instance. Because the Save as Template flow persists operator secrets verbatim, the response often contains database passwords, API keys, and other credentials suitable for follow-on access to backing services and connected infrastructure.

No verified proof-of-concept code is publicly available. See the GitHub Security Advisory GHSA-cxx3-hr75-4q96 for vendor technical details.

Detection Methods for CVE-2026-42461

Indicators of Compromise

Unauthenticated HTTP GET requests against /api/templates and subpaths in Arcane access logs
Responses returning Compose YAML or .env content without a preceding authenticated session
Sequential enumeration of template identifiers from a single source IP

Detection Strategies

Review Arcane reverse proxy and application logs for GET /api/templates* requests lacking an Authorization header or session cookie
Correlate template read activity from non-administrative IP ranges with subsequent authentication events on services whose credentials are stored in templates
Compare the running Arcane version against 1.18.0 across managed hosts to identify exposed instances

Monitoring Recommendations

Alert on any external network access to Arcane management URLs that should be internal-only
Monitor for credential reuse where secrets stored in Arcane templates appear in authentication attempts elsewhere
Track template read volume baselines and flag spikes consistent with bulk enumeration

How to Mitigate CVE-2026-42461

Immediate Actions Required

Upgrade Arcane to version 1.18.0 or later on all instances
Rotate every credential, API key, and password that was stored in any custom template prior to patching
Restrict network exposure of the Arcane management interface to trusted administrative networks or a VPN
Audit access logs for unauthenticated GET requests against /api/templates* since deployment

Patch Information

The vulnerability is fixed in Arcane 1.18.0, which adds the missing Security requirement to the affected GET endpoints. Refer to the GitHub Release v1.18.0 and the GitHub Security Advisory GHSA-cxx3-hr75-4q96 for full patch details.

Workarounds

Place Arcane behind a reverse proxy that requires authentication on /api/templates* until the upgrade is applied
Remove sensitive values from existing custom templates and inject secrets at deploy time from an external secret store
Block external access to the Arcane API at the network layer where remote management is not required

bash

# Example reverse proxy enforcement (nginx) to require auth on template endpoints
location /api/templates {
    auth_request /_auth;
    proxy_pass http://arcane_backend;
}