What is the CVSS score of CVE-2026-40242?

CVE-2026-40242 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Docker are affected by CVE-2026-40242?

Arcane Docker management interface versions before 1.17.3 contain an unauthenticated server-side request forgery vulnerability that allows remote attackers to access internal network resources and…. A patch is available.

Is there a public PoC exploit available for CVE-2026-40242?

Yes, a public proof-of-concept exploit is available for CVE-2026-40242. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-40242?

Within 24 hours: Identify all Arcane Docker instances and document current versions via 'docker inspect' or management console. Within 7 days: Contact Arcane vendor for patch availability timeline and interim guidance; implement network-layer restrictions to the /api/templates/fetch endpoint (firewall rules, WAF blocks on that URI). Within 30 days: Upgrade to Arcane version 1.17.3 or later once released and validated in non-production; perform post-upgrade verification that the /api/templates/fetch endpoint validates and restricts URL schemes and hosts.

Docker CVE-2026-40242

EUVD-2026-21599 HIGH

Server-Side Request Forgery (SSRF) (CWE-918)

2026-04-10 GitHub_M

GHSA-ff24-4prj-gpmj

SSRF Docker

7.2

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Re-analysis Queued

Apr 21, 2026 - 19:07 vuln.today

cvss_changed

Patch released

Apr 11, 2026 - 02:30 nvd

Patch available

EUVD ID Assigned

Apr 10, 2026 - 21:00 euvd

EUVD-2026-21599

Analysis Generated

Apr 10, 2026 - 21:00 vuln.today

CVE Published

Apr 10, 2026 - 20:34 nvd

HIGH 7.2

DescriptionGitHub Advisory

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 1.17.3, the /api/templates/fetch endpoint accepts a caller-supplied url parameter and performs a server-side HTTP GET request to that URL without authentication and without URL scheme or host validation. The server's response is returned directly to the caller. type. This constitutes an unauthenticated SSRF vulnerability affecting any publicly reachable Arcane instance. This vulnerability is fixed in 1.17.3.

AnalysisAI

Server-side request forgery in Arcane Docker management interface versions prior to 1.17.3 allows unauthenticated remote attackers to conduct SSRF attacks via the /api/templates/fetch endpoint. Attackers can supply arbitrary URLs through the url parameter, causing the server to perform HTTP GET requests without URL scheme or host validation, with responses returned directly to the caller. This enables reconnaissance of internal network resources, access to cloud metadata endpoints, and potential interaction with internal services from the server's network context. No public exploit identified at time of analysis.

Technical ContextAI

The vulnerability stems from insufficient input validation in the template fetching API endpoint. The server accepts arbitrary URLs via the url parameter and performs server-initiated HTTP GET requests using the CWE-918 pattern without URL filtering, authentication requirements, or allowlist validation. CVSS vector PR:N confirms unauthenticated access, while scope change (S:C) reflects cross-trust boundary resource access characteristic of SSRF exploitation.

RemediationAI

Vendor-released patch: version 1.17.3. Upgrade immediately to Arcane 1.17.3 or later to resolve SSRF vulnerability. The fix implements URL validation controls for the /api/templates/fetch endpoint. As interim mitigation, restrict network access to Arcane management interface using firewall rules or authentication proxies to prevent unauthenticated external access. For environments unable to upgrade immediately, disable the vulnerable /api/templates/fetch endpoint through web application firewall rules or reverse proxy configuration. Official advisory and patched release available at https://github.com/getarcaneapp/arcane/security/advisories/GHSA-ff24-4prj-gpmj and https://github.com/getarcaneapp/arcane/releases/tag/v1.17.3