S4E just found a high top 10 tcp port service scan
high·Misconfiguration·Updated Aug 11, 2026

CVE-2026-42461 Scanner

CVE-2026-42461 Scanner - Information Disclosure vulnerability in Arcane

Est. Time~10 seconds
Scan TypeGroup Scan
Targetsdomain, subdomain, ipv4
CostFree
0
Times Used
by S4E users
0
Assets Scanned
domains & IPs
0
Vulnerabilities Found
confirmed findings
References
CVECVE-2026-42461
8.7
CVSShigh
Exploitable remotely over the internet · no authentication required.

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to version 1.18.0, four GET endpoints under /api/templates* in Arcane's Huma backend are registered without any Security requirement, allowing any unauthenticated network client to list and read the full Compose YAML and .env content of every custom template stored in the instance. Because Arcane's UI exposes a "Save as Template" flow on the project / swarm-stack creation pages that persists the operator's real env content (database passwords, API keys, etc.) verbatim, this missing authorization is an unauthenticated read of operator secrets in practice — not a theoretical info-disclosure. The frontend explicitly treats /customize/templates/* as an authenticated area (PROTECTED_PREFIXES in frontend/src/lib/utils/redirect.util.ts), and every CRUD operation (POST/PUT/DELETE) on the same paths requires a Bearer/API key, so this is a clear backend authorization gap, not intended public access. This issue has been patched in version 1.18.0.

Attack Vector
Network
Privileges Req.
None
User Interaction
None
Affected
arcaneby getarcaneapp
< 1.18.0
Updated Aug 19, 2026View on NVD →
Detail

Arcane is a software tool used by developers and system administrators to manage and deploy applications using templates and environment variables. It is primarily used for orchestrating containerized applications and managing configuration files across various environments, facilitating streamlined deployment processes. Arcane enables DevOps teams to maintain consistency in application configurations and streamlines the configurations' distribution across staging, development, and production environments. It is targeted towards medium to large-scale enterprises that require robust configuration management solutions. By leveraging templates and environment variables, Arcane helps teams maintain consistency, reduce configuration drift, and automate deployment processes efficiently. The software is widely adopted in environments where rapid deployment and consistent application configurations are paramount.

The Information Disclosure vulnerability in Arcane versions below 1.18.0 arises due to missing authorization checks on its /api/templates GET endpoints. The lack of authorization allows unauthenticated attackers to access sensitive data, including configuration files and environment variables. This vulnerability poses significant security risks as it exposes critical information such as database passwords and API keys, which attackers could leverage to gain unauthorized access to systems. The flaw highlights the importance of implementing stringent access controls, especially on endpoints that handle sensitive data. Developers and system administrators must be vigilant and ensure that their services enforce proper authentication and authorization mechanisms to prevent such disclosures. The vulnerability underscores a common issue in many software applications where security checks are inadequately enforced or completely missing.

In Arcane, the vulnerable endpoints reside within the application's API, specifically the /api/templates and /api/templates/{template_id}/content endpoints. These endpoints fail to enforce required authentication, permitting anyone with network access to retrieve sensitive configuration data. The vulnerability is primarily located in how these endpoints handle GET requests without validating the requester's credentials. The attack could involve crafting HTTP requests to these vulnerable endpoints to exploit the information disclosure flaw, allowing attackers to extract critical environment files. The exploit requires minimal effort beyond network access, making it easily exploitable by a remote attacker. Due to its nature, the vulnerability can be considered a high-risk scenario for organizations running vulnerable versions of the software.

When this vulnerability is exploited, it leads to the exposure of sensitive information stored in the affected system, including but not limited to database credentials and operational secrets. Such an exposure has the potential to compromise the entire network by giving adversaries the ability to escalate privileges or perform lateral moves within the network. The impact on affected organizations could be extensive, leading to financial loss, data breaches, and reputational damage. The ability to access and manipulate environment-specific secrets without authentication presents a severe security risk, potentially enabling attackers to alter configurations or exfiltrate confidential data. Organizations must recognize the urgency in addressing this vulnerability to mitigate the risks associated with unauthorized data access.

REFERENCES

Solution Advice
  • Update Arcane to version 1.18.0 or later to ensure that the vulnerability is patched.
  • Implement strict authentication checks on all application endpoints to prevent unauthorized access.
  • Regularly review and audit access logs to identify any unauthorized access attempts.
  • Employ network-level restrictions to limit access to sensitive endpoints only to authorized users.
  • Conduct regular security assessments to detect and remediate potential security flaws proactively.

Get AI-powered remediation steps tailored to your asset.

Try AI Solutions →

Check your infrastructure.
Right now.

11,000+ scanners. Free to start. No credit card required.