Executive brief
Arcane is a Docker management application that allows users to define and deploy container templates. A vulnerability in versions before 2.0.0 allows any authenticated user with a standard account to create, modify, or delete container templates—including system-wide defaults—without proper permission checks. An attacker could inject malicious configurations that mount the host filesystem or grant administrative privileges, which would then be deployed and executed by administrators, effectively compromising the entire host system.
Technical details
The vulnerability is an authorization bypass due to missing RequireAdmin middleware on five template mutation endpoints in backend/api/handlers/templates.go (POST /api/templates, PUT /api/templates/{id}, DELETE /api/templates/{id}, POST /api/templates/{id}/download, and POST /api/templates/default). These endpoints require bearer or API key authentication but lack the RequireAdmin check that is correctly applied to similar registry management endpoints in the same file. An authenticated user with the default "user" role can exploit this to inject a malicious Docker Compose configuration with privileged settings or host volume mounts into any template or replace the system-wide default template. When an administrator later deploys the poisoned template, the resulting container executes with full privileges, leading to host-level compromise. The fix is to add the RequireAdmin middleware to the five affected endpoint registrations.
Affected products
- Arcane Arcane before 2.0.0
Timeline
- 2026-06-04: disclosed: Vulnerability reported via email
- 2026-09-05: advisory: CVE-2026-86114 published