# github.com/getarcaneapp/arcane/backend (Go) vulnerabilities 10 known vulnerabilities (2 critical, 6 high, 2 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: v1.20.0 (Jun 4, 2026): affected by 3 advisories - Newest unaffected release: Every release is affected by at least one advisory - Releases: 20 since v1.15.3 (Feb 20, 2026) - Registry: https://pkg.go.dev/github.com/getarcaneapp/arcane/backend - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-96627: v1.15.3 to v1.20.0 (through the newest release) - CVE-2026-96628: v1.15.3 to v1.20.0 (through the newest release) - CVE-2026-45625: v1.15.3 to v1.18.1 (v1.19.0 is outside it) - CVE-2026-45626: v1.15.3 to v1.20.0 (through the newest release) - CVE-2026-45627: v1.15.3 to v1.18.1 (v1.19.0 is outside it) - CVE-2026-47125: v1.15.3 to v1.19.1 (v1.19.2 is outside it) - CVE-2026-47179: v1.15.3 to v1.19.3 (v1.19.4 is outside it) - CVE-2026-42461: v1.15.3 to v1.17.4 (v1.18.0 is outside it) - CVE-2026-40242: v1.15.3 to v1.17.2 (v1.17.3 is outside it) - CVE-2026-23520: no published release is affected ## Advisories (10) ### [CVE-2026-96627](https://cve.now/CVE-2026-96627): Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check) - Severity: High 8.8 - Published: Oct 16, 2026 - Affected: all versions. - No fix released. The latest release, v1.20.0, is still affected. ### [CVE-2026-96628](https://cve.now/CVE-2026-96628): Arcane: Environment access token bypasses the admin-required authorization gate on \`/api/debug/pprof\` - Severity: Medium 4.3 - Published: Oct 16, 2026 - Affected: all versions. - No fix released. The latest release, v1.20.0, is still affected. ### [CVE-2026-45625](https://cve.now/CVE-2026-45625): Arcane: Missing admin authorization on git repository endpoints allows non-admin users to exfiltrate stored Git credentials and tamper… - Severity: Critical 9.9 - Published: May 29, 2026 - Affected: fixed in 1.19.0. - Fixed in v1.19.0 (released May 11, 2026, 18 days before disclosure). - The latest release, v1.20.0, is not affected. ### [CVE-2026-45626](https://cve.now/CVE-2026-45626): Arcane: OS Command Injection in Volume Browser ListDirectory via path query parameter - Severity: Medium 6.3 - Published: May 29, 2026 - Affected: all versions; through 1.18.1. - No fix released. The latest release, v1.20.0, is still affected. ### [CVE-2026-45627](https://cve.now/CVE-2026-45627): Arcane: Unauthenticated reflected XSS via SVG color parameter in /api/app-images/logo enables admin account takeover - Severity: High 8.2 - Published: May 29, 2026 - Affected: fixed in 1.19.0. - Fixed in v1.19.0 (released May 11, 2026, 18 days before disclosure). - The latest release, v1.20.0, is not affected. ### [CVE-2026-47125](https://cve.now/CVE-2026-47125): Arcane: Missing admin authorization on global variables endpoint - Severity: High 8.8 - Published: May 29, 2026 - Affected: fixed in 1.19.2. - Fixed in v1.19.2 (released May 17, 2026, 12 days before disclosure). - The latest release, v1.20.0, is not affected. ### [CVE-2026-47179](https://cve.now/CVE-2026-47179): Arcane: Authenticated Arbitrary Host File Read via Docker Compose Include Directives in Arcane - Severity: High 7.7 - Published: May 29, 2026 - Affected: fixed in 1.19.4. - Fixed in v1.19.4 (released May 18, 2026, 11 days before disclosure). - The latest release, v1.20.0, is not affected. ### [CVE-2026-42461](https://cve.now/CVE-2026-42461): Arcane Vulnerable to Unauthenticated Disclosure of Custom Compose Template Content (incl. \`.env\` secrets) - Severity: High 8.7 - Published: May 9, 2026 - Affected: fixed in 1.18.0. - Fixed in v1.18.0 (released Apr 23, 2026, 16 days before disclosure). - The latest release, v1.20.0, is not affected. ### [CVE-2026-40242](https://cve.now/CVE-2026-40242): Arcane Unauthenticated SSRF with Conditional Response Reflection in Template Fetch Endpoint - Severity: High 7.2 - Published: Apr 10, 2026 - Affected: fixed in 1.17.3. - Fixed in v1.17.3 (released Apr 10, 2026, the day of disclosure). - The latest release, v1.20.0, is not affected. ### [CVE-2026-23520](https://cve.now/CVE-2026-23520): Arcane has a Command Injection in Arcane Updater Lifecycle Labels Enables RCE - Severity: Critical 9.1 - Published: Jan 15, 2026 - Affected: fixed in 0.0.0-20260114065515-5a9c2f92e11f. - Fixed in v1.15.3 (released Feb 20, 2026, 36 days after disclosure, the advisory names 0.0.0-20260114065515-5a9c2f92e11f, which was never published). - The latest release, v1.20.0, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/go/github.com/getarcaneapp/arcane/backend Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.