Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-86114— Arcane before 2.0.0 Missing Administrator Authorization on the Compose Template Mutation Endpoints

Quick assessment

Affected
getarcaneapp arcane
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Arcane是Arcane公司开源的一款功能多样的软件产品。 Arcane 2.0.0之前版本存在授权问题漏洞，该漏洞源于对模板操作限制不当，允许默认用户角色账户创建、修改和删除compose模板，攻击者可注入具有特权设置或主机路径挂载的恶意容器配置，在管理员部署时以管理权限执行。

CVSS 6.5 · Medium EPSS 0.24% · P16

Possible ATT&CK Techniques 1 AI

T1555 · Credentials from Password Stores

Affected Version Matrix 1

VendorProduct Version RangeStatus
getarcaneapp arcane 1.19.1< 2.0.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-86114

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Arcane before 2.0.0 Missing Administrator Authorization on the Compose Template Mutation Endpoints
Source: CVE Program / CVE List V5
Vulnerability Description
Arcane versions before 2.0.0 fail to properly restrict template operations, allowing default user role accounts to create, modify, and delete compose templates including instance-wide defaults. Attackers can inject malicious container configurations with privileged settings or host path mounts that execute with administrative privileges when deployed by administrators.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5
Vulnerability Title
Arcane 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Arcane是Arcane公司开源的一款功能多样的软件产品。 Arcane 2.0.0之前版本存在授权问题漏洞，该漏洞源于对模板操作限制不当，允许默认用户角色账户创建、修改和删除compose模板，攻击者可注入具有特权设置或主机路径挂载的恶意容器配置，在管理员部署时以管理权限执行。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
getarcaneapp arcane 1.19.1 ~ 2.0.0 -

II. Public POCs for CVE-2026-86114

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-86114

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-86114 (1)

Proof of Concept for CVE-2026-86114 (1)

Other References for CVE-2026-86114 (1)

IV. Related Vulnerabilities

Same product: arcane
Same vendor: getarcaneapp
Same weakness: CWE-862

V. Comments for CVE-2026-86114

No comments yet

Leave a comment