Executive brief
Arcane, an interface for managing Docker environments, contains a security flaw where non-administrator users can modify global system settings. By overwriting shared environment variables, an attacker can redirect application traffic, steal database credentials, or force the system to run malicious software. This allows a low-privileged user to compromise all projects managed by the platform and potentially take control of the underlying server.
Technical details
A missing authorization check in the 'PUT /api/environments/{id}/templates/variables' endpoint allows any authenticated user with a valid bearer token or API key to overwrite the '.env.global' file. This file is used for variable substitution across all project Docker Compose files. By injecting or overriding variables such as REGISTRY, IMAGE, or DATABASE_URL, an attacker can facilitate a supply-chain attack by redirecting image pulls to malicious registries or exfiltrating credentials. The vulnerability stems from the 'UpdateGlobalVariables' handler failing to invoke the 'checkAdmin' helper used elsewhere in the codebase. Additionally, insufficient sanitization of the 'key' field allows for arbitrary newline injection into the environment file. A fix is available in version 1.19.2.
Affected products
- getarcaneapp Arcane < 1.19.2
Timeline
- 2026-05-17: advisory: GitHub Security Advisory published
- 2026-05-29: disclosed: CVE published to NVD
- 2026-05-29: patched: Vulnerability fixed in version 1.19.2