CVE-2026-40242

MediumCVSS 6.5/10Last modified Oct 26, 2026

Description

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 1.17.3, the /api/templates/fetch endpoint accepts a caller-supplied url parameter and performs a server-side HTTP GET request to that URL without authentication and without URL scheme or host validation. The server's response is returned directly to the caller. type. This constitutes an unauthenticated SSRF vulnerability affecting any publicly reachable Arcane instance. This vulnerability is fixed in 1.17.3.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-918

Affected software

Vendor	Product	Versions
getarcaneapp	arcane	< 1.17.3

References

https://github.com/getarcaneapp/arcane/releases/tag/v1.17.3Release Notes
https://github.com/getarcaneapp/arcane/security/advisories/GHSA-ff24-4prj-gpmjExploit, Vendor Advisory
https://github.com/getarcaneapp/arcane/security/advisories/GHSA-ff24-4prj-gpmjExploit, Vendor Advisory

Timeline

Published: Apr 10, 2026
Last modified: Oct 26, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-402434.8Incus is a system container and virtual machine manager. In versions before 7.0.0, broken TLS validation logic in the OVN database connectio CVE-2026-402447.1OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture indus CVE-2026-402457.5Free5GC is an open-source Linux Foundation project for 5th generation (5G) mobile core networks. Versions 4.2.1 and below contain an informa CVE-2026-402467.5free5GC is an open-source implementation of the 5G core network. In versions 1.4.2 and below of the UDR service, the handler for deleting Tr CVE-2026-402477.5free5GC is an open-source implementation of the 5G core network. In versions 4.2.1 and below of the UDR service, the handler for reading Tra CVE-2026-402487.5free5GC is an open-source implementation of the 5G core network. In versions 4.2.1 and below of the UDR service, the handler for creating or CVE-2026-402495.3free5GC is an open-source implementation of the 5G core network. In versions 4.2.1 and below of the UDR service, the PUT handler for updatin CVE-2026-40256.4The PrivateContent Free plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'align' shortcode attribute in the [pc-log CVE-2026-402507.1OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture indus CVE-2026-402516.5Incus is a system container and virtual machine manager. In versions before 7.0.0, missing validation logic in the storage volume import log CVE-2026-402528.1FastGPT is an AI Agent building platform. Prior to 4.14.10.4, Broken Access Control vulnerability (IDOR/BOLA) allows any authenticated team CVE-2026-402536.1openCryptoki is a PKCS#11 library and provides tooling for Linux and AIX. In versions 3.26.0 and below, the BER/DER decoding functions in th