CVE-2026-23944: Arcane authentication bypass (CVSS 9.8)

Description

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to version 1.13.2, unauthenticated requests could be proxied to remote environment agents, allowing access to remote environment resources without authentication. The environment proxy middleware handled `/api/environments/{id}/...` requests for remote environments before authentication was enforced. When the environment ID was not local, the middleware proxied the request and attached the manager-held agent token, even if the caller was unauthenticated. This enabled unauthenticated access to remote environment operations (e.g., listing containers, streaming logs, or other agent endpoints). An unauthenticated attacker could access and manipulate remote environment resources via the proxy, potentially leading to data exposure, unauthorized changes, or service disruption. Version 1.13.2 patches the vulnerability.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

ScopeUnchanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Arcane< 1.13.2

Remediation

Fixed in

Arcane≥ 1.13.2

Patch & vendor advisories

References

https://github.com/getarcaneapp/arcane/commit/2008e1b93b25d0c4c3fff3af07843766231614ebPatch
https://github.com/getarcaneapp/arcane/pull/1532Issue TrackingPatchVendor Advisory
https://github.com/getarcaneapp/arcane/releases/tag/v1.13.2Release Notes
https://github.com/getarcaneapp/arcane/security/advisories/GHSA-2jv8-39rp-cqqrPatchVendor Advisory

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2026-23944 being actively exploited?

CVE-2026-23944 is not in the CISA KEV catalog. Its EPSS exploit probability is 0.52%.

How severe is CVE-2026-23944?

CVE-2026-23944 has a CVSS 3.1 base score of 9.8, rated critical. EPSS estimates a 0.52% probability of exploitation.

Which products are affected by CVE-2026-23944?

Affected products include Arcane.

How do I fix CVE-2026-23944?

Upgrade affected software to a fixed version, for example Arcane 1.13.2 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2026-23944 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo