CVE-2026-40242High· 7.2▾ MidnightPoC availableArcane has Unauthenticated SSRF with Conditional Response Reflection in Template Fetch Endpoint
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 39.6 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Jul 21.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.6%
Nuclei ×1
The /api/templates/fetch endpoint accepts a caller-supplied url parameter and performs a server-side HTTP GET request to that URL without authentication and without URL scheme or host validation. The server's response is returned directly to the caller. type. This constitutes an unauthenticated SSRF vulnerability affecting any publicly reachable Arcane instance.
Response handling produces four distinct outcomes observable by the caller:
"Invalid JSON response: invalid character '<'...")"connection refused") and filtered ones ("i/o timeout")Send an unauthenticated GET request to /api/templates/fetch, passing the target URL as the url query parameter.
github.com/getarcaneapp/arcane/backend < 1.17.3Upgrade to a patched release:
github.com/getarcaneapp/arcane/backend 1.17.3Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-47179High· 7.7Arcane Has an Authenticated Arbitrary Host File Read via Docker Compose Include Directives
CVE-2026-86114Medium· 6.5Arcane versions before 2.0.0 fail to properly restrict template operations, allowing default user role accounts to create, modify, and delete compose templates including instance-wide defaults