CVE-2026-40242: SSRF in Arcane Docker Management Interface

The SSRF vulnerability in Arcane allows attackers to bypass access controls and potentially access internal services and data that are not directly exposed to the internet. An attacker could craft a malicious URL to the /api/templates/fetch endpoint, instructing Arcane to retrieve data from internal network resources, cloud metadata services (like AWS or Azure instance details), or even external websites. This could lead to information disclosure, privilege escalation, or further exploitation of other vulnerabilities within the internal network. The lack of authentication and URL validation makes this vulnerability particularly concerning, as any publicly accessible Arcane instance is at risk.

1. Reserved2026-04-10
2. Published2026-04-10
3. Modified2026-04-13
4. EPSS updated2026-04-18

The primary mitigation for CVE-2026-40242 is to immediately upgrade Arcane to version 1.17.3 or later. If upgrading is not immediately feasible, consider implementing temporary workarounds such as restricting network access to the Arcane instance using a firewall or network segmentation. A Web Application Firewall (WAF) could be configured to block requests to the /api/templates/fetch endpoint or filter requests based on the URL scheme and host. Monitor Arcane logs for suspicious activity, specifically requests to unusual or internal URLs. After upgrading, confirm the fix by attempting to access an internal resource via the /api/templates/fetch endpoint; the request should be denied.