Detections
Analytics
SCA: security update for github.com/getarcaneapp/arcane/backend (GHSA-gjqq-6r35-w3r8)
high Tenable Cloud Security Plugin ID 436794
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- Arcane provides modern docker management. Prior to 1.13.0, Arcane has a command injection in the updater
service. Arcane’s updater service supported lifecycle labels com.getarcaneapp.arcane.lifecycle.pre-update
and com.getarcaneapp.arcane.lifecycle.post-update that allowed defining a command to run before or after a
container update. The label value is passed directly to /bin/sh -c without sanitization or validation.
Because any authenticated user (not limited to administrators) can create projects through the API, an
attacker can create a project that specifies one of these lifecycle labels with a malicious command. When
an administrator later triggers a container update (either manually or via scheduled update checks),
Arcane reads the lifecycle label and executes its value as a shell command inside the container. This
vulnerability is fixed in 1.13.0. (CVE-2026-23520)
See Also
Plugin Details
Severity: High
ID: 436794
Version: Revision 1.5
Type: Local
Family: SCA Checks
Published: 1/16/2026
Updated: 7/2/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: High
Score: 7.7
Percentile: 99.07
Vendor
Vendor Severity: Critical
CVSS v2
Risk Factor: High
Base Score: 9
Temporal Score: 7
Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C
CVSS Score Source: CVE-2026-23520
CVSS v3
Risk Factor: High
Base Score: 8
Temporal Score: 7.2
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
Vulnerability Information
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 1/15/2026
Vulnerability Publication Date: 1/15/2026
Reference Information
CVE: CVE-2026-23520
cwe: CWE-78