Arcane is an interface for managing Docker containers, images, networks, and volumes.

Code

The project this record applies to. Exploit listings stay in References.

• Repository · github.com

Timeline

Detection, updates, and resolution for this record.

1. Apr 10, 2026 · NIST NVD

   Detected

   Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 1.17.3, the /api/templates/fetch endpoint accepts a caller-supplied url parameter and performs a server-side HTTP GET request to that URL without authentication and without URL scheme or host validation. The server's response is returned directly to the caller. type. This constitutes an unauthenticated S

2. Jun 17, 2026 · NIST NVD

   Updated

   Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 1.17.3, the /api/templates/fetch endpoint accepts a caller-supplied url parameter and performs a server-side HTTP GET request to that URL without authentication and without URL scheme or host validation. The server's response is returned directly to the caller. type. This constitutes an unauthenticated S

Affected

• cpe getarcane/arcaneversion unspecified

Sources

• CVE.orgVulnerability recordCVE-2026-40242

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-40242

  Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 1.17.3, the /api/templates/fetch endpoint accepts a caller-supplied url parameter and performs a server-side HTTP GET request to that URL without authentication and without URL scheme o

  nvd.nist.gov

References

• Release Notes · github.com
• Exploit · github.com