EUVD-2026-71946
GHSA-pj2x-fr4j-wrxq
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
PR:L for required user account; UI:R because admin must deploy the poisoned template; S:C and C/I/A:H reflect host-level container escape as the realized impact.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
5DescriptionCVE.org
Arcane versions before 2.0.0 fail to properly restrict template operations, allowing default user role accounts to create, modify, and delete compose templates including instance-wide defaults. Attackers can inject malicious container configurations with privileged settings or host path mounts that execute with administrative privileges when deployed by administrators.
AnalysisAI
Template mutation endpoints in Arcane before 2.0.0 permit any authenticated low-privilege user to create, modify, or delete compose templates - including instance-wide defaults - without administrator authorization. By injecting malicious container definitions containing privileged flags or host path mounts, an attacker can backdoor shared templates so that when an administrator deploys a stack from them, the containers execute with root-level access to the Docker host. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid Arcane user account with the default (non-admin) user role; unauthenticated access is not sufficient. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 4.0 base score of 7.1 uses PR:L and VI:H but holds all subsequent-system metrics at N, which materially understates the real-world impact - the ultimate consequence of successful exploitation is host-level root access via a privileged Docker container, warranting SC:H/SI:H/SA:H. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Arcane v2.0.0 or later, which contains the authorization fix introduced in commit 1500646aa91f (https://github.com/getarcaneapp/arcane/commit/1500646aa91f); the release is available at https://github.com/getarcaneapp/arcane/releases/tag/v2.0.0. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Arcane instances running versions prior to 2.0.0 and audit template modification logs for unauthorized changes or suspicious configurations. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-862 – Missing Authorization
View allShare
External POC / Exploit Code
Leaving vuln.today