Skip to content
Heist/ feed
Back to feed
High

Arcane: Missing admin authorization on global variables endpoint

Type: advisorySources: OSV

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 1.19.2, the PUT /api/environments/{id}/templates/variables endpoint, which writes the system-wide .env.global file used for variable substitution in every project's compose file, is missing an admin authorization check. Any authenticated non-admin user can call this endpoint with their bearer token or API key and overwrite the global environment variables that are merged into every project deployment. By overriding values like REGISTRY, IMAGE, DATABASE_URL, or SECRET_KEY that other users reference via ${VAR} in compose files, an attacker can redirect image pulls to attacker-controlled registries (supply-chain RCE on the Docker host), exfiltrate database credentials, or disrupt all projects. This vulnerability is fixed in 1.19.2.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-47125
Confirmed fixed CVEs
Not specified
Updated in this feed
4 Nov 2026, 23:40 UTC · Revision 1

Source evidence

Arcane: Missing admin authorization on global variables endpoint

core-osv · Original source

Published 29 May 2026, 17:07 UTC

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 1.19.2, the PUT /api/environments/{id}/templates/variables endpoint, which writes the system-wide .env.global file used for variable substitution in every project's compose file, is missing an admin authorization check. Any authenticated non-admin user can call this endpoint with their bearer token or API key and overwrite the global environment variables that are merged into every project deployment. By overriding values like REGISTRY, IMAGE, DATABASE_URL, or SECRET_KEY that other users reference via ${VAR} in compose files, an attacker can redirect image pulls to attacker-controlled registries (supply-chain RCE on the Docker host), exfiltrate database credentials, or disrupt all projects. This vulnerability is fixed in 1.19.2.

osv:CVE-2026-47125
Complete source record
{
  "id": "9854d1baf8316c363818dbe80d35eb1636dd5cc6e6278dbfa97ed48dca3b0944",
  "url": "https://osv.dev/vulnerability/CVE-2026-47125",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Arcane: Missing admin authorization on global variables endpoint",
    "summary": "Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 1.19.2, the PUT /api/environments/{id}/templates/variables endpoint, which writes the system-wide .env.global file used for variable substitution in every project's compose file, is missing an admin authorization check. Any authenticated non-admin user can call this endpoint with their bearer token or API key and overwrite the global environment variables that are merged into every project deployment. By overriding values like REGISTRY, IMAGE, DATABASE_URL, or SECRET_KEY that other users reference via ${VAR} in compose files, an attacker can redirect image pulls to attacker-controlled registries (supply-chain RCE on the Docker host), exfiltrate database credentials, or disrupt all projects. This vulnerability is fixed in 1.19.2.",
    "evidence": "osv:CVE-2026-47125",
    "products": [],
    "severity": "high",
    "structured": {
      "id": "CVE-2026-47125",
      "aliases": [
        "CVE-2026-47125",
        "GHSA-jpjh-jm2p-39hh",
        "GO-2026-5476"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/getarcaneapp/arcane",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "dd81632ae3c8dd455aad898802f0179970e53ede"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "1.19.2"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StringRangeExpression"
                  },
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "1.19.2"
                      }
                    ],
                    "source": "DESCRIPTION"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v1.19.1",
            "types/v1.19.1",
            "cli/v1.19.1",
            "backend/v1.19.1",
            "v1.19.0",
            "types/v1.19.0",
            "cli/v1.19.0",
            "backend/v1.19.0",
            "v1.18.1",
            "types/v1.18.1",
            "cli/v1.18.1",
            "backend/v1.18.1",
            "v1.18.0",
            "types/v1.18.0",
            "cli/v1.18.0",
            "backend/v1.18.0",
            "v1.17.4",
            "types/v1.17.4",
            "cli/v1.17.4",
            "backend/v1.17.4",
            "v1.17.3",
            "types/v1.17.3",
            "cli/v1.17.3",
            "backend/v1.17.3",
            "v1.17.2",
            "types/v1.17.2",
            "cli/v1.17.2",
            "backend/v1.17.2",
            "v1.17.1",
            "types/v1.17.1",
            "cli/v1.17.1",
            "backend/v1.17.1",
            "v1.17.0",
            "types/v1.17.0",
            "cli/v1.17.0",
            "backend/v1.17.0",
            "v1.16.3",
            "types/v1.16.3",
            "cli/v1.16.3",
            "backend/v1.16.3",
            "v1.16.2",
            "types/v1.16.2",
            "cli/v1.16.2",
            "backend/v1.16.2",
            "v1.16.1",
            "types/v1.16.1",
            "cli/v1.16.1",
            "backend/v1.16.1",
            "v1.16.0",
            "types/v1.16.0",
            "cli/v1.16.0",
            "backend/v1.16.0",
            "v1.15.3",
            "types/v1.15.3",
            "cli/v1.15.3",
            "backend/v1.15.3",
            "v1.15.2",
            "types/v1.15.2",
            "cli/v1.15.2",
            "v1.15.1",
            "types/v1.15.1",
            "cli/v1.15.1",
            "v1.15.0",
            "types/v1.15.0",
            "cli/v1.15.0",
            "v1.14.1",
            "v1.14.0",
            "v1.13.2",
            "v1.13.1",
            "v1.13.0",
            "v1.12.2",
            "v1.12.1",
            "v1.12.0",
            "v1.11.3",
            "v1.11.2",
            "v1.11.1",
            "v1.11.0",
            "v1.10.1",
            "v1.10.0",
            "v1.9.0",
            "v1.8.1",
            "v1.8.0",
            "v1.7.1",
            "v1.7.0",
            "v1.6.0",
            "v1.5.2",
            "v1.5.1",
            "v1.5.0",
            "v1.4.0",
            "v1.3.0",
            "v1.2.2",
            "v1.2.1",
            "v1.2.0",
            "v1.1.0",
            "v1.0.2",
            "v1.0.1",
            "v1.0.0",
            "v0.15.1",
            "v0.15.0",
            "v0.14.0",
            "v0.13.1",
            "v0.13.0",
            "v0.12.0",
            "v0.11.1",
            "v0.11.0",
            "v0.10.0",
            "v0.9.2",
            "v0.9.1",
            "v0.9.0",
            "v0.8.0",
            "v0.7.1",
            "v0.7.0",
            "v0.6.0",
            "v0.5.0",
            "v0.4.1",
            "v0.4.0",
            "v0.3.0",
            "v0.2.0",
            "v0.1.1",
            "v0.1.0"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-47125.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:40.706167855Z",
      "provider": "osv",
      "references": [
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47125.json",
        "https://github.com/getarcaneapp/arcane/security/advisories/GHSA-jpjh-jm2p-39hh",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-47125"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-862"
        ],
        "cna_assigner": "GitHub_M",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47125.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-47125",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 508076,
  "published_at": "2026-05-29T17:07:21.675+00:00"
}