Security
فارسی
All products

github.com/getarcaneapp/arcane/backend

Go · Package
10 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
Arcane: Environment access token bypasses the admin-required authorization gate on `/api/debug/pprof`CVE-2026-96628 · GHSA-MP22-58FF-6FHRVersion ranges need review. github.com/getarcaneapp/arcane/backend/v2github.com/getarcaneapp/arcane/backend Go Medium Fix reported
Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check)CVE-2026-96627 · GHSA-PW5Q-RJX4-7F7PVersion ranges need review. github.com/getarcaneapp/arcane/backend/v2github.com/getarcaneapp/arcane/backend Go High Fix reported
Arcane has Unauthenticated SSRF with Conditional Response Reflection in Template Fetch EndpointCVE-2026-40242 · GHSA-FF24-4PRJ-GPMJVersion ranges need review. github.com/getarcaneapp/arcane/backend Go High Fix reported
Arcane Has an Authenticated Arbitrary Host File Read via Docker Compose Include DirectivesCVE-2026-47179 · GHSA-C3PX-H233-H6FQVersion ranges need review. github.com/getarcaneapp/arcane/backend Go High Fix reported
Arcane Backend: Unauthenticated reflected XSS via SVG color parameter enables admin account takeoverCVE-2026-45627 · GHSA-Q2PJ-8V84-9MH5Version ranges need review. github.com/getarcaneapp/arcane/backend Go High Fix reported
Arcane: Missing admin authorization on global variables endpointCVE-2026-47125 · GHSA-JPJH-JM2P-39HHVersion ranges need review. github.com/getarcaneapp/arcane/backend Go High Fix reported
Arcane Backend: OS Command Injection in Volume Browser ListDirectory via path query parameterCVE-2026-45626 · GHSA-9MVM-4GWG-V8MPVersion ranges need review. github.com/getarcaneapp/arcane/backend Go Medium No fix reported
Arcane Vulnerable to Unauthenticated Disclosure of Custom Compose Template Content (incl. `.env` secrets) CVE-2026-42461 · GHSA-CXX3-HR75-4Q96Version ranges need review. github.com/getarcaneapp/arcane/backend Go High Fix reported
Arcane Backend: Missing admin authorization on git repository endpoints allows non-admin users to exfiltrate stored Git credentials and tamper with GitOps configsCVE-2026-45625 · GHSA-7H26-HG47-P9HXVersion ranges need review. github.com/getarcaneapp/arcane/backend Go Critical Fix reported
Arcane Has a Command Injection in Arcane Updater Lifecycle Labels That Enables RCECVE-2026-23520 · GHSA-GJQQ-6R35-W3R8Version ranges need review. github.com/getarcaneapp/arcane/backend Go Critical Fix reported