Description

Arcane versions before 2.0.0 fail to properly restrict template operations, allowing default user role accounts to create, modify, and delete compose templates including instance-wide defaults. Attackers can inject malicious container configurations with privileged settings or host path mounts that execute with administrative privileges when deployed by administrators.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-05T10:16:42.423Z",
  "pubdate": "2026-09-05T10:16:42.423Z",
  "executiveSummary": "Arcane versions prior to 2.0.0 contain a critical access control vulnerability related to the management of compose templates. The software fails to enforce proper authorization checks for template operations, permitting users assigned the default role to create, modify, and delete templates, including those designated as instance-wide defaults.\nThis flaw allows low-privileged attackers to inject malicious container configurations. By manipulating templates, an attacker can define privileged settings or host path mounts that execute with administrative privileges once the template is subsequently deployed by an unsuspecting administrator. The vulnerability poses a significant risk to the integrity and confidentiality of the host environment, as it facilitates privilege escalation and potential system compromise. Successful exploitation requires authenticated access to the Arcane platform with default user privileges, but does not require administrative rights to initiate the attack sequence. Remediation is necessary to prevent unauthorized template modification and subsequent administrative-level execution of malicious payloads.",
  "technicalDetails": "The root cause of this vulnerability lies in an insecure authorization model within the template management component of Arcane versions before 2.0.0. The application fails to distinguish between the permissions granted to default user accounts and those reserved for administrators when performing CRUD (Create, Read, Update, Delete) operations on compose templates.\nThe attack flow initiates when an authenticated user, assigned the 'default' role, leverages the exposed template management API endpoints. Because the backend fails to validate the user's role against the requested operation, the attacker can manipulate existing templates or inject entirely new ones into the system's global storage. An attacker exploits this by defining a malicious container configuration within a template that includes dangerous directives, such as elevated process capabilities, running as the root user, or mounting sensitive host filesystems (e.g., /etc, /var/run/docker.sock) into the container namespace.\nThe malicious payload remains latent within the template until an administrator selects that template for deployment. Once the administrator deploys the compromised template, the Arcane engine processes the configuration, resulting in the container being instantiated with the injected privileged settings. This effectively facilitates a privilege escalation attack; the attacker’s malicious code executes with the host-level privileges of the deployment service or the administrative user context, potentially leading to a full system compromise. The vulnerability is fundamentally a failure of server-side input validation and attribute-based access control (ABAC). There is no mechanism to verify that the creator of a template possesses the requisite authority to dictate configuration parameters that impact the broader infrastructure. Furthermore, because the vulnerability encompasses instance-wide default templates, an attacker can achieve persistence or influence administrative actions system-wide, significantly expanding the impact beyond their own user environment. The exploitation process requires no special network exposure beyond what is typical for an Arcane user, as the flaw is internal to the application logic and authorization enforcement layer."
}