CVE-2026-86114: Missing Authorization in getarcaneapp arcane
Description
Arcane versions before 2.0.0 fail to properly restrict template operations, allowing default user role accounts to create, modify, and delete compose templates including instance-wide defaults. Attackers can inject malicious container configurations with privileged settings or host path mounts that execute with administrative privileges when deployed by administrators.
CVSS v4.0
Score 7.1high
Affected software
getarcaneapp
arcane
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-86114 is a missing authorization vulnerability in Arcane prior to version 2.0.0. The flaw allows users with default roles to perform unauthorized template operations such as creating, modifying, and deleting compose templates, including those that affect instance-wide defaults. Exploiting this vulnerability, attackers can inject container configurations that include privileged settings or host path mounts, which execute with administrative privileges upon deployment by administrators. The CVSS 4.0 score is 7.1, indicating a high severity vulnerability with network attack vector, low attack complexity, no privileges required beyond default user role, no user interaction, and high impact on integrity.
Potential Impact
Attackers with default user roles can escalate privileges by injecting malicious container configurations that run with administrative privileges. This can lead to unauthorized administrative actions and potential full system compromise when administrators deploy the malicious templates.
Mitigation Recommendations
A fix is available in Arcane version 2.0.0 and later. Users should upgrade to version 2.0.0 or newer to remediate this vulnerability. No other mitigation guidance is provided in the input data.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-09-05T01:59:20.258Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a9bed73acd9273b49b1c66a
Added to database: 09/05/2026, 10:22:43 UTC
Last enriched: 09/25/2026, 02:47:11 UTC
Last updated: 10/20/2026, 18:48:24 UTC
Views: 105
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.