Getarcaneapp vulnerabilities
We track 9 vulnerabilities in Getarcaneapp products. 9 are rated high or critical, and none are known to be exploited. The most recent was published on October 16, 2026.
Latest Getarcaneapp vulnerabilities
- 8.8 High severity
arcane: Incorrect Privilege Assignment
Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.6.0, UpdateUser in backend/api/handlers/users.go sets PasswordHash for any target without comparing caller and target privilege. A holder of delegated users:update
- 8.5 High severity
arcane: Exposure of Sensitive Information to an Unauthorized Actor
Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.5.0, UpdateRegistry and TestRegistry in backend/api/services/container_registry_service.go allow the registry URL to change while preserving the stored encrypted t
- 7.7 High severity
arcane: Improper Limitation of a Pathname to a Restricted Directory
Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 1.19.4, ProjectService.GetProjectFileContent returns the contents of any Docker Compose include directive declared in a project's compose file before any path-traver
- 8.8 High severity
arcane: Missing Authorization
Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 1.19.2, the PUT /api/environments/{id}/templates/variables endpoint, which writes the system-wide .env.global file used for variable substitution in every project's
- 8.2 High severity
arcane: Improper Neutralization of Input During Web Page Generation
Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 1.19.0, the unauthenticated GET /api/app-images/logo endpoint reflects a user-supplied color query parameter into the body of an SVG document via strings.ReplaceAll
- 9.9 Critical severity
arcane: Missing Authorization
Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 1.19.0, Arcane's huma-based REST API exposes nine endpoints under /api/customize/git-repositories and /api/git-repositories/sync for managing GitOps source repositor
- 7.5 High severity
arcane: Missing Authorization
Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to version 1.18.0, four GET endpoints under /api/templates* in Arcane's Huma backend are registered without any Security requirement, allowing any unauthenticated netwo
- 9.8 Critical severity
arcane: Missing Authentication for Critical Functionality
Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to version 1.13.2, unauthenticated requests could be proxied to remote environment agents, allowing access to remote environment resources without authentication. The e
- 8.0 High severity
arcane: Improper Neutralization of Special Elements used in an OS Command
Arcane provides modern docker management. Prior to 1.13.0, Arcane has a command injection in the updater service. Arcane’s updater service supported lifecycle labels com.getarcaneapp.arcane.lifecycle.pre-update and com.getarcaneapp.arcane.lifecycle.post-update