CVE-2026-86114: Arcane before 2.0.0 Missing Administrator Authorization on the Compose Template Mutation Endpoints
Arcane versions before 2.0.0 fail to properly restrict template operations, allowing default user role accounts to create, modify, and delete compose templates including instance-wide defaults. Attackers can inject malicious container configurations with privileged settings or host path mounts that execute with administrative privileges when deployed by administrators.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Arcaneto a version that resolves this vulnerability.Fixed in 2.0.0 - Compensating control
Restrict access to the Arcane Compose Template Mutation Endpoints so only administrators can create, modify, or delete compose templates.
Event History
Frequently Asked Questions
Who can exploit this issue?
An account with the default user role can exploit it. The attacker does not need administrator authorization, but must be able to access the compose template mutation endpoints.
What is the practical impact of a successful exploit?
A low-privileged user can create, modify, or delete compose templates, including instance-wide default templates. They can inject privileged container settings or host path mounts that may execute with administrative privileges when an administrator deploys the affected template.
Are default configurations affected?
Yes. The issue specifically affects default user role accounts and includes the ability to alter instance-wide default compose templates.
What should be done if immediate upgrading is not possible?
Restrict access to the compose template mutation endpoints so default user role accounts cannot create, modify, or delete templates. Review templates, especially instance-wide defaults, for unexpected privileged settings or host path mounts before administrators deploy them.
How can administrators identify possible prior abuse?
Review compose templates and instance-wide default templates for unauthorized changes, particularly privileged container configurations and host path mounts. Check whether templates were created, modified, or deleted by accounts assigned the default user role.