Executive brief
Arcane, a management interface for Docker containers and infrastructure, contains a security flaw that allows anyone with network access to view sensitive configuration files without logging in. These files often contain "secrets" such as database passwords, API keys, and encryption tokens used by the organization's applications. An attacker could use this information to gain unauthorized access to other internal systems, databases, or third-party services.
Technical details
A missing authorization check in the Huma backend of Arcane allows unauthenticated access to several template-related API endpoints (/api/templates, /api/templates/all, /api/templates/{id}, and /api/templates/{id}/content). The root cause is the omission of a 'Security' block in the huma.Register calls within backend/internal/huma/handlers/templates.go, which causes the authentication middleware to skip token verification. Because the "Save as Template" workflow persists environment variables verbatim, an attacker can retrieve plain-text secrets including database credentials and API keys from the .env content of stored templates. This vulnerability is addressed in version 1.18.0 by enforcing authentication by default across all API endpoints.
Affected products
- getarcaneapp Arcane < 1.18.0
Timeline
- 2026-04-23: patched: Version 1.18.0 released
- 2026-04-23: advisory: GitHub Security Advisory published
- 2026-05-09: disclosed: CVE published to NVD