CVE-2026-40242
Unauthenticated SSRF in Arcane /api/templates/fetch Endpoint
Publication date: 2026-04-10
Last updated on: 2026-04-21
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| getarcane | arcane | to 1.17.3 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-918 | The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in Arcane, an interface for managing Docker containers, images, networks, and volumes. Prior to version 1.17.3, the /api/templates/fetch endpoint accepts a URL parameter from the caller and performs a server-side HTTP GET request to that URL without any authentication or validation of the URL's scheme or host.
Because the server returns the response directly to the caller, this creates an unauthenticated Server-Side Request Forgery (SSRF) vulnerability. This means an attacker can make the server send HTTP requests to arbitrary URLs, potentially accessing internal or protected resources.
How can this vulnerability impact me? :
This SSRF vulnerability can allow an attacker to make the vulnerable Arcane server send HTTP requests to internal or external systems without authentication.
The impact includes potential unauthorized access to internal services, exposure of sensitive information, and possible manipulation of internal network resources.
The CVSS score of 7.2 indicates a high severity with low attack complexity, no privileges required, and no user interaction needed, making exploitation relatively easy and impactful.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, upgrade Arcane to version 1.17.3 or later, where the SSRF issue in the /api/templates/fetch endpoint has been fixed.