CVE-2026-86114: Arcane Privilege Escalation Vulnerability

CVE-2026-86114 Overview

CVE-2026-86114 is a missing authorization vulnerability [CWE-862] in Arcane, a Docker management platform, affecting all versions before 2.0.0. The flaw allows accounts holding the default user role to create, modify, and delete compose templates, including instance-wide default templates. An attacker with low-privileged access can inject malicious container configurations containing privileged flags or host path mounts. When an administrator later deploys the tampered template, the malicious container executes with administrative privileges on the host.

Critical Impact
Low-privileged users can persist malicious compose templates that gain administrative container privileges when deployed by administrators, enabling container escape and host compromise.

Affected Products

Arcane (getarcaneapp/arcane) versions prior to 2.0.0
Arcane manager component compose template API (backend/api/handlers/templates.go)
Deployments running the Arcane manager image ghcr.io/getarcaneapp/arcane

Discovery Timeline

2026-09-05 - CVE-2026-86114 published to NVD
2026-09-05 - Last updated in NVD database

Technical Details for CVE-2026-86114

Vulnerability Analysis

Arcane exposes REST endpoints that mutate compose templates used to deploy Docker stacks. In releases before 2.0.0, the template handlers in backend/api/handlers/templates.go enforced authentication but did not verify that the calling identity held administrator privileges. Any authenticated account with the default user role could invoke the create, update, and delete operations, including operations targeting instance-wide default templates.

Because compose templates define container runtime settings, an attacker can embed properties such as privileged: true, host path bind mounts to /, or Docker socket mounts at /var/run/docker.sock. The malicious template is later deployed by an administrator, at which point the container inherits administrator authority over the Docker daemon and the underlying host.

Root Cause

The root cause is a missing authorization check on state-changing endpoints. Authentication was validated, but role-based access control was not applied to template mutation routes. The fix delivered in commit 1500646aa91f introduces a dedicated RoleService and full role-based access control (RBAC) coverage across the API surface, wiring authorization enforcement into template operations.

Attack Vector

Exploitation requires network access to the Arcane manager API and valid credentials for any account with the default user role. The attacker submits a crafted compose template through the vulnerable mutation endpoint. When an administrator subsequently deploys the template, the malicious container definition executes with the privileges granted by the compose specification.

// Security patch: backend/api/api.go - feat: full rbac permissions (#2724)
// A new RoleService is registered so template handlers can enforce
// administrator-only authorization on compose template mutations.
    Webhook           *services.WebhookService
    Vulnerability     *services.VulnerabilityService
    Dashboard         *services.DashboardService
    Role              *services.RoleService
    Config            *config.Config
}

Source: GitHub Commit 1500646aa91f

Detection Methods for CVE-2026-86114

Indicators of Compromise

Compose templates containing privileged: true, pid: host, network_mode: host, or bind mounts to /, /etc, or /var/run/docker.sock.
Template create, update, or delete API calls originating from accounts that do not hold the administrator role.
Unexpected modifications to instance-wide default compose templates.
New or altered templates appearing outside of change-control windows.

Detection Strategies

Audit Arcane API access logs for POST, PUT, and DELETE requests against template routes correlated with the authenticated user's role.
Diff current compose templates against a known-good baseline to identify unauthorized changes.
Alert on container launches where the parent template was recently modified by a non-administrator identity.

Monitoring Recommendations

Forward Arcane manager and Docker daemon logs to a centralized analytics platform for correlation.
Monitor Docker events for containers started with --privileged, sensitive host mounts, or Docker socket exposure.
Track template version history and enable alerting on changes to default templates.

How to Mitigate CVE-2026-86114

Immediate Actions Required

Upgrade Arcane to version 2.0.0 or later, which introduces full RBAC coverage on template mutation endpoints.
Review all existing compose templates for injected privileged settings or host path mounts before deploying any stack.
Rotate credentials for administrator and default user accounts and audit account role assignments.
Restrict network access to the Arcane manager API to trusted operator networks.

Patch Information

The fix is delivered in Arcane Release v2.0.0 via commit 1500646aa91f, which adds a RoleService and enforces administrator authorization on compose template create, update, and delete operations. See the VulnCheck Advisory for Arcane for additional details.

Workarounds

If immediate patching is not possible, remove or downgrade default user role accounts so that only administrators retain access.
Require administrator review and diff of any compose template prior to deployment.
Place the Arcane manager API behind an authenticating reverse proxy that enforces role-based access at the edge.

bash

# Verify running Arcane manager image is v2.0.0 or later
docker inspect --format '{{.Config.Image}}' arcane-manager
docker image inspect ghcr.io/getarcaneapp/arcane:latest \
  --format '{{ index .Config.Labels "org.opencontainers.image.version" }}'

# List templates and flag risky compose fields for manual review
grep -REn 'privileged:\s*true|/var/run/docker.sock|pid:\s*host|network_mode:\s*host' \
  /var/lib/arcane/templates/