Detections
Analytics

SCA: security update for github.com/getarcaneapp/arcane/backend (GHSA-cxx3-hr75-4q96)

high Tenable Cloud Security Plugin ID 441040

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to version
 1.18.0, four GET endpoints under /api/templates* in Arcane's Huma backend are registered without any
 Security requirement, allowing any unauthenticated network client to list and read the full Compose YAML
 and .env content of every custom template stored in the instance. Because Arcane's UI exposes a "Save as
 Template" flow on the project / swarm-stack creation pages that persists the operator's real env content
 (database passwords, API keys, etc.) verbatim, this missing authorization is an unauthenticated read of
 operator secrets in practice — not a theoretical info-disclosure. The frontend explicitly treats
 /customize/templates/* as an authenticated area (PROTECTED_PREFIXES in
 frontend/src/lib/utils/redirect.util.ts), and every CRUD operation (POST/PUT/DELETE) on the same paths
 requires a Bearer/API key, so this is a clear backend authorization gap, not intended public access. This
 issue has been patched in version 1.18.0. (CVE-2026-42461)

Solution

Update the github.com/getarcaneapp/arcane/backend library and its related packages to version 1.18.0 or later.

See Also

https://github.com/advisories/GHSA-cxx3-hr75-4q96

Plugin Details

Severity: High

ID: 441040

Version: Revision 1.9

Type: Local

Family: SCA Checks

Published: 5/1/2026

Updated: 6/30/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.73

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N

CVSS Score Source: CVE-2026-42461

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: High

Base Score: 8.7

Threat Score: 6.6

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 4/30/2026

Vulnerability Publication Date: 4/30/2026

Reference Information

CVE: CVE-2026-42461

cwe: CWE-862