CVE-2026-86114

Medium

Description

Arcane versions before 2.0.0 fail to properly restrict template operations, allowing default user role accounts to create, modify, and delete compose templates including instance-wide defaults. Attackers can inject malicious container configurations with privileged settings or host path mounts that execute with administrative privileges when deployed by administrators.

SeverityMedium

CVSS6.5

Exploit probability—

ProductArcane

PublishedSep 5, 2026

First seenSep 5, 2026

Weakness typeCWE-862Missing authorization

How to fix

Update

getarcaneapp arcane2.0.0 or later

Patches

github.com/getarcaneapp/arcane/commit/1500646aa91f

Vendor advisories

github.com/getarcaneapp/arcane/releases/tag/v2.0.0

Affected products

Product	Affected versions	Fixed in
getarcaneapp arcane	1.19.1 ≤ v < 2.0.0	2.0.0

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.