CVE-2026-45626: Arcane OS command injection in volume browser

CVE-2026-45626 · Severity: medium · CVSS 6.3 · Published 2026-05-29

Arcane, a management interface for Docker environments, contains a security flaw in its volume browsing feature. An authenticated user can use specially crafted file paths to run unauthorized commands inside a temporary container used by the system. While the commands are restricted to an isolated environment without network access, an attacker could still view sensitive file data or delete volume contents that they should not be able to modify.

Technologies: Arcane backend, github.com/getarcaneapp/arcane/backend (Go). Vendors: Arcane, Go.

Quick answers

Is CVE-2026-45626 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-45626 being exploited in the wild.
How severe is CVE-2026-45626?
Medium severity, with a CVSS score of 6.3, published 29 May 2026.
Which products and versions are affected?
Arcane backend <= 1.18.1; github.com/getarcaneapp/arcane/backend (Go) <= 1.18.1, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=1.18.1.
Is there a fix for CVE-2026-45626?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-45626 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-45626?
Check whether you run Arcane backend or github.com/getarcaneapp/arcane/backend (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An OS command injection vulnerability exists in the `GET /environments/{id}/volumes/{volumeName}/browse` endpoint of Arcane. The `path` query parameter is processed by `sanitizeBrowsePathInternal`, which filters directory traversal (`../`) but fails to strip shell metacharacters like `$()` or backticks. The resulting string is passed to `sh -c` via `fmt.Sprintf` and `strconv.Quote`. Because `strconv.Quote` only escapes Go-specific characters, the shell still performs command substitution. An authenticated attacker can execute commands inside the helper container; although the container lacks network access and privileged status, command output is reflected in 500 error responses, enabling data exfiltration from the mounted volume. Additionally, the same sanitization flaw allows for recursive volume deletion via the DELETE method.

Affected products

  • getarcaneapp Arcane <= 1.18.1

Identifiers

  • CVE-2026-45626
  • GHSA-9mvm-4gwg-v8mp
  • GO-2026-5292

Timeline

  • 2026-05-11: advisory: GitHub Security Advisory published
  • 2026-05-29: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.