CRITICAL9.9Go
GHSA-7h26-hg47-p9hx· CVE-2026-45625, GO-2026-5220Arcane Backend: Missing admin authorization on git repository endpoints allows non-admin users to exfiltrate stored Git credentials and tamper with GitOps configs
Modified: 6/25/2026
package
Go/github.com/getarcaneapp/arcane/backend
pkg:go/github.com/getarcaneapp/arcane/backend
MEDIUM6.3Go
GHSA-9mvm-4gwg-v8mp· CVE-2026-45626, GO-2026-5292Arcane Backend: OS Command Injection in Volume Browser ListDirectory via path query parameter
Modified: 6/25/2026
HIGH7.7Go
GHSA-c3px-h233-h6fq· CVE-2026-47179, GO-2026-5308Arcane Has an Authenticated Arbitrary Host File Read via Docker Compose Include Directives
Modified: 7/21/2026
HIGHGo
GHSA-cxx3-hr75-4q96· CVE-2026-42461, GO-2026-5340Arcane Vulnerable to Unauthenticated Disclosure of Custom Compose Template Content (incl. `.env` secrets)
Modified: 6/25/2026
HIGH7.2Go
GHSA-ff24-4prj-gpmj· CVE-2026-40242, GO-2026-5356Arcane has Unauthenticated SSRF with Conditional Response Reflection in Template Fetch Endpoint
Modified: 7/21/2026
CRITICAL9.0Go
GHSA-gjqq-6r35-w3r8· CVE-2026-23520, GO-2026-4320Arcane Has a Command Injection in Arcane Updater Lifecycle Labels That Enables RCE
Modified: 2/3/2026
HIGH8.8Go
GHSA-jpjh-jm2p-39hh· CVE-2026-47125, GO-2026-5476Arcane: Missing admin authorization on global variables endpoint
Modified: 6/25/2026
HIGH8.2Go
GHSA-q2pj-8v84-9mh5· CVE-2026-45627, GO-2026-5561Arcane Backend: Unauthenticated reflected XSS via SVG color parameter enables admin account takeover
Modified: 6/25/2026
—Go
GO-2026-4320· CVE-2026-23520, GHSA-gjqq-6r35-w3r8Arcane Has a Command Injection in Arcane Updater Lifecycle Labels That Enables RCE in github.com/getarcaneapp/arcane/backend
Modified: 3/3/2026
—Go
GO-2026-5220· CVE-2026-45625, GHSA-7h26-hg47-p9hxArcane Backend: Missing admin authorization on git repository endpoints allows non-admin users to exfiltrate stored Git credentials and tamper with GitOps configs in github.com/getarcaneapp/arcane/backend
Modified: 6/25/2026
—Go
GO-2026-5292· CVE-2026-45626, GHSA-9mvm-4gwg-v8mpArcane Backend: OS Command Injection in Volume Browser ListDirectory via path query parameter in github.com/getarcaneapp/arcane/backend
Modified: 6/25/2026
—Go
GO-2026-5308· CVE-2026-47179, GHSA-c3px-h233-h6fqArcane Has an Authenticated Arbitrary Host File Read via Docker Compose Include Directives in github.com/getarcaneapp/arcane/backend
Modified: 6/25/2026
—Go
GO-2026-5340· CVE-2026-42461, GHSA-cxx3-hr75-4q96Arcane Vulnerable to Unauthenticated Disclosure of Custom Compose Template Content (incl. `.env` secrets) in github.com/getarcaneapp/arcane/backend
Modified: 6/25/2026
—Go
GO-2026-5356· CVE-2026-40242, GHSA-ff24-4prj-gpmjArcane has Unauthenticated SSRF with Conditional Response Reflection in Template Fetch Endpoint in github.com/getarcaneapp/arcane/backend
Modified: 6/25/2026
—Go
GO-2026-5476· CVE-2026-47125, GHSA-jpjh-jm2p-39hhArcane: Missing admin authorization on global variables endpoint in github.com/getarcaneapp/arcane/backend
Modified: 6/25/2026
—Go
GO-2026-5561· CVE-2026-45627, GHSA-q2pj-8v84-9mh5Arcane Backend: Unauthenticated reflected XSS via SVG color parameter enables admin account takeover in github.com/getarcaneapp/arcane/backend
Modified: 6/25/2026