PT-2026-3097 · Arcane · Arcane

Denizparlak · Published 2026-01-15 · Updated 2026-02-05 · CVE-2026-23520

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Arcane versions prior to 1.13.0

Description Arcane’s updater service allows defining commands to run before or after container updates using lifecycle labels com.getarcaneapp.arcane.lifecycle.pre-update and com.getarcaneapp.arcane.lifecycle.post-update. The value of these labels is passed directly to /bin/sh -c without proper validation, creating a command injection issue. Any authenticated user can create projects via the API and specify malicious commands within these lifecycle labels. When an administrator triggers a container update, Arcane executes the command within the container. If the container has host volume mounts, the executed command may access the host filesystem, potentially leading to data theft or full host compromise if sensitive paths like /var/run/docker.sock are mounted. The issue enables remote code execution (RCE) within the container context.

Recommendations Versions prior to 1.13.0 should be updated to version 1.13.0 or later.

Exploit

Fix

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2026-01841

CVE-2026-23520

GHSA-GJQQ-6R35-W3R8

GO-2026-4320

SUSE-SU-2026:0292-1

Affected Products

Arcane

References · 33

• 🔥 https://github.com/getarcaneapp/arcane/commit/5a9c2f92e11f86f8997da8c672844468f930b7e4 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23520.json · Exploit
• https://github.com/getarcaneapp/arcane/security/advisories/GHSA-gjqq-6r35-w3r8 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-23520 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-gjqq-6r35-w3r8 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4320 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23520 · Security Note
• https://bdu.fstec.ru/vul/2026-01841 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2026:0292-1 · Vendor Advisory
• https://github.com/getarcaneapp/arcane · Note
• https://github.com/getarcaneapp/arcane/releases/tag/v1.13.0 · Note
• https://github.com/getarcaneapp/arcane/pull/1468 · Note
• https://suse.com/security/cve/CVE-2026-23511 · Note
• https://twitter.com/pulsepatchio/status/2012533602802888894 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2012007525403545629 · Twitter Post