arcane up to 1.13.1 /api/environments/ missing authentication

Summaryinfo

A vulnerability, which was classified as critical, was found in arcane up to 1.13.1. Affected is an unknown function of the file /api/environments/. The manipulation results in missing authentication. This vulnerability was named CVE-2026-23944. The attack may be performed from remote. There is no available exploit. You should upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, was found in arcane up to 1.13.1. Affected is some unknown functionality of the file /api/environments/. The manipulation with an unknown input leads to a missing authentication vulnerability. CWE is classifying the issue as CWE-306. The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to version 1.13.2, unauthenticated requests could be proxied to remote environment agents, allowing access to remote environment resources without authentication. The environment proxy middleware handled `/api/environments/{id}/...` requests for remote environments before authentication was enforced. When the environment ID was not local, the middleware proxied the request and attached the manager-held agent token, even if the caller was unauthenticated. This enabled unauthenticated access to remote environment operations (e.g., listing containers, streaming logs, or other agent endpoints). An unauthenticated attacker could access and manipulate remote environment resources via the proxy, potentially leading to data exposure, unauthorized changes, or service disruption. Version 1.13.2 patches the vulnerability.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-23944 since 01/19/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. There are known technical details, but no exploit is available.

Upgrading to version 1.13.2 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 2008e1b93b25d0c4c3fff3af07843766231614eb is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-3280). Once again VulDB remains the best source for vulnerability data.

Productinfo

Name

• arcane

Version

• 1.13.0
• 1.13.1

License

• open-source

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion