CVE-2026-40242 Details
Description
Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 1.17.3, the /api/templates/fetch endpoint accepts a caller-supplied url parameter and performs a server-side HTTP GET request to that URL without authentication and without URL scheme or host validation. The server's response is returned directly to the caller. type. This constitutes an unauthenticated SSRF vulnerability affecting any publicly reachable Arcane instance. This vulnerability is fixed in 1.17.3.
A server-side request forgery (SSRF) vulnerability has been identified in Arcane versions prior to 1.17.3. The vulnerability exists in the '/api/templates/fetch' endpoint, which accepts a user-supplied URL parameter and performs an HTTP GET request to that URL. This is done without authentication and without validating the URL scheme or host. The response from the server is returned directly to the caller. This vulnerability allows for unauthenticated access to internal services and networks, potentially leading to unauthorized service discovery or access to sensitive information.
Users can upgrade to Arcane version 1.17.3 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/getarcaneapp/arcane/security/advisories/GHSA-ff24-4prj-gpmj | CISA-ADP | ExploitVendor Advisory |
| https://github.com/getarcaneapp/arcane/releases/tag/v1.17.3 | [email protected] | Release Notes |
| https://github.com/getarcaneapp/arcane/security/advisories/GHSA-ff24-4prj-gpmj | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| getarcane arcane | < 1.17.3 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 21, 2026 | Initial Analysis | [email protected] |
| Apr 13, 2026 | CVE Modified | CISA-ADP |
| Apr 10, 2026 | New CVE Received | [email protected] |