Executive brief
Arcane, an application for managing templates, contains a security flaw in its template fetching feature. An unauthenticated attacker can use the server to send requests to internal network services that are not normally accessible from the internet. This could allow an attacker to scan internal networks, discover private services, or access sensitive internal dashboards and APIs.
Technical details
An unauthenticated SSRF vulnerability exists in the /api/templates/fetch endpoint of Arcane due to a lack of validation on the user-supplied 'url' parameter. The application performs a GET request to the provided URL without verifying the scheme, host, or destination CIDR. The vulnerability allows for conditional response reflection: valid JSON responses are reflected, while non-JSON responses or connection errors leak specific error messages (e.g., first-byte leaks or TCP timeouts). This can be exploited to perform internal port scanning and access internal-only HTTP services like Kubernetes APIs or metadata endpoints. The issue is fixed in version 1.17.3.
Affected products
- getarcaneapp Arcane backend <= 1.17.2
Timeline
- 2026-04-10: disclosed
- 2026-04-10: advisory
- 2026-04-10: patched: Fixed in version 1.17.3