CVE-2026-40242 json
Arcane Unauthenticated SSRF with Conditional Response Reflection in Template Fetch Endpoint
published 2026-04-10 6 mo ago modified 2026-10-26 13 d ago also EUVD-2026-21599 , GHSA-ff24-4prj-gpmj , GO-2026-5356
- cvss
- 7.2
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.6%
- EPSS 0.6% chance of exploitation in 30 days, percentile 50%
- public exploits
- 0
- none known, plus a Nuclei check
Summary
Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 1.17.3, the /api/templates/fetch endpoint accepts a caller-supplied url parameter and performs a server-side HTTP GET request to that URL without authentication and without URL scheme or host validation. The server's response is returned directly to the caller. type. This constitutes an unauthenticated SSRF vulnerability affecting any publicly reachable Arcane instance. This vulnerability is fixed in 1.17.3.
Patch / fix
- go github.com/getarcaneapp/arcane/backend 1.17.3
- arcane arcane 1.17.3
- getarcane arcane 1.17.3
- govulncheck-vulndb openSUSE Leap 16.0 0.0.20260723T184607-160000.1.1
opensuse advisories openSUSE-SU-2026:21483-1
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 6 mo ago
Exploit prediction
0.62% chance of exploitation in the next 30 days, higher than 50% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Nuclei template Arcane <= 1.17.2 - Server-Side Request Forgery nuclei detection template
- github.com https://github.com/getarcaneapp/arcane/security/advisories/GHSA-ff24-4prj-gpmj referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.2 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N |
| GitHub | 3.1 | 7.2 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N |
| NVD | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | github.com/getarcaneapp/arcane/backend | <1.17.3 |
1.17.3 |
Affected products
- getarcaneapp arcane
Classification
- Weakness
-
- CWE-918 Server-Side Request Forgery
References
-
github.com
/getarcaneapp/arcane/security/advisories/GHSA-ff24-4prj-gpmj
exploit, web, vendor-advisory, advisory
-
github.com
/getarcaneapp/arcane/releases/tag/v1.17.3
web, release-notes
-
nvd.nist.gov
/vuln/detail/CVE-2026-40242
advisory
-
github.com
/getarcaneapp/arcane
package
Sources
- CVE List CVE-2026-40242
- GitHub Advisory GHSA-ff24-4prj-gpmj
- NVD CVE-2026-40242
- OSV GO-2026-5356
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.