PT-2026-3510 · Arcane · Arcane

Pvtsec · Published 2026-01-19 · Updated 2026-05-11 · CVE-2026-23944

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Arcane versions prior to 1.13.2

Description Arcane, an interface for managing Docker containers, images, networks, and volumes, had a flaw where unauthenticated requests could be forwarded to remote environment agents, granting access to remote environment resources without proper authentication. The environment proxy middleware processed requests for remote environments via the /api/environments/{id}/... API endpoint before authentication was applied. Specifically, when the environment ID (id) was not local, the middleware forwarded the request, attaching the manager-held agent token, even without caller authentication. This allowed an unauthenticated attacker to access and manipulate remote environment resources through the proxy, potentially resulting in data exposure, unauthorized modifications, or service disruption.

Recommendations Update to version 1.13.2 or later.

Exploit

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2026-23944

GHSA-2JV8-39RP-CQQR

Affected Products

Arcane

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23944.json · Exploit
• https://github.com/getarcaneapp/arcane/commit/2008e1b93b25d0c4c3fff3af07843766231614eb · Patch
• https://github.com/getarcaneapp/arcane/pull/1532 · Patch
• https://github.com/getarcaneapp/arcane/security/advisories/GHSA-2jv8-39rp-cqqr · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-23944 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23944 · Security Note
• https://github.com/getarcaneapp/arcane/releases/tag/v1.13.2 · Note
• https://twitter.com/CVEnew/status/2013364754929328550 · Twitter Post
• https://twitter.com/vuldb/status/2053718396492234995 · Twitter Post