CVE-2026-45626

Arcane includes a feature for looking through stored Docker volume files. A flaw in that feature can allow an authorized user to turn a file-browsing request into instructions for the supporting container to run. It is like a staff member using a filing-room request form to slip in unrelated instructions for the building’s maintenance system.

This matters to you if you use Arcane to manage Docker containers and volumes. Review accounts that can use Arcane’s volume-browsing feature, especially accounts shared with developers, contractors, or other users. It is only a risk if an attacker already has a login and access to a browseable volume.

A logged-in user with volume-browsing access can trigger the attack without needing someone else to click anything, so treat this as an amber-priority access-control issue. There is no recorded public exploit code, and CISA has not listed it among vulnerabilities known to be actively exploited. Restrict the feature now and track the vendor’s fix.

Confirm exposure by identifying Arcane deployments that offer the volume-browsing endpoint and reviewing which authenticated roles can browse volumes. Versions through 1.18.1 are affected; no patched target version or upgrade path has been published, so obtain the vendor’s remediation guidance before scheduling an upgrade.

If patching is delayed, disable or tightly restrict volume browsing, limit Arcane access to trusted administrators, and remove unnecessary access to browseable volumes. Review Arcane and helper-container logs for unusual requests to /environments/{id}/volumes/{volumeName}/browse, unexpected shell errors, or unexplained commands. CISA has not assigned a KEV remediation due date.

CVE-2026-45626 is CVSS 6.3 (Medium): CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. It is CWE-78 OS command injection in the Volume Browser ListDirectory flow: the path query parameter reaches a sh -c command in an Arcane helper container, while filtering blocks ../ traversal but not Bourne-shell substitutions such as $() and backticks. Exploitation requires authenticated access to a browseable volume; command output can be reflected in a 500 response. It is not in CISA KEV, no public exploit code is recorded, and EPSS is 0.2% (12th percentile) with a flat trend; press attention is rising.