CVE-2026-40242 PoC — arcane 代码问题漏洞

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-40242.yaml

Associated Vulnerability

Title:arcane 代码问题漏洞 (CVE-2026-40242)
Description:arcane是Arcane开源的一个Docker管理软件。 Arcane 1.17.3之前版本存在代码问题漏洞，该漏洞源于/api/templates/fetch端点接受调用者提供的url参数并进行无身份验证、无URL方案或主机验证的服务端HTTP GET请求，可能导致未经验证的服务端请求伪造。

Description

Arcane <= 1.17.3 contains an unauthenticated server-side request forgery caused by lack of URL scheme and host validation in /api/templates/fetch endpoint, letting remote attackers perform SSRF, exploit requires no authentication.

File Snapshot


 id: CVE-2026-40242

info:
  name: Arcane <= 1.17.2 - Server-Side Request Forgery
  author: 0x_Akoko


...

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!