CVE-2026-47125: Arcane missing authorization in global variables endpoint

CVE-2026-47125 · Severity: high · CVSS 8.8 · Published 2026-05-29

Arcane, an interface for managing Docker environments, contains a security flaw where non-administrator users can modify global system settings. By overwriting shared environment variables, an attacker can redirect application traffic, steal database credentials, or force the system to run malicious software. This allows a low-privileged user to compromise all projects managed by the platform and potentially take control of the underlying server.

Technologies: Arcane backend, github.com/getarcaneapp/arcane/backend (Go). Vendors: Arcane, Go.

Quick answers

Is CVE-2026-47125 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-47125 being exploited in the wild.
How severe is CVE-2026-47125?
High severity, with a CVSS score of 8.8, published 29 May 2026.
Which products and versions are affected?
Arcane backend <= 1.19.1; github.com/getarcaneapp/arcane/backend (Go) <= 1.19.1, SEMVER:introduced=0,fixed=1.19.2.
Is there a fix for CVE-2026-47125?
Yes. github.com/getarcaneapp/arcane/backend (Go): upgrade to 1.19.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-47125 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-47125?
Check whether you run Arcane backend or github.com/getarcaneapp/arcane/backend (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/getarcaneapp/arcane/backend (Go): upgrade to 1.19.2 or later
    go get github.com/getarcaneapp/arcane/backend@v1.19.2

Technical details

A missing authorization check in the 'PUT /api/environments/{id}/templates/variables' endpoint allows any authenticated user with a valid bearer token or API key to overwrite the '.env.global' file. This file is used for variable substitution across all project Docker Compose files. By injecting or overriding variables such as REGISTRY, IMAGE, or DATABASE_URL, an attacker can facilitate a supply-chain attack by redirecting image pulls to malicious registries or exfiltrating credentials. The vulnerability stems from the 'UpdateGlobalVariables' handler failing to invoke the 'checkAdmin' helper used elsewhere in the codebase. Additionally, insufficient sanitization of the 'key' field allows for arbitrary newline injection into the environment file. A fix is available in version 1.19.2.

Affected products

  • getarcaneapp Arcane < 1.19.2

Identifiers

  • CVE-2026-47125
  • GHSA-jpjh-jm2p-39hh
  • GO-2026-5476

Timeline

  • 2026-05-17: advisory: GitHub Security Advisory published
  • 2026-05-29: disclosed: CVE published to NVD
  • 2026-05-29: patched: Vulnerability fixed in version 1.19.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.