CVE-2026-86114

Arcane before 2.0.0 does not properly enforce authorization (CWE-862) on compose template operations, so accounts holding only the default user role can create, modify, and delete templates, including instance-wide defaults. An attacker with such an account can inject a malicious container configuration using privileged settings or host path mounts into a shared template. When an administrator later deploys that template, the injected container runs with administrative-level privileges, giving the attacker effectively privileged code execution in the deployment. Any Arcane deployment running a version prior to 2.0.0 that grants access to default user role accounts is affected. There is no known public proof-of-concept, the flaw is not in CISA KEV, and EPSS estimates only a 0.2% probability of exploitation in the next 30 days, so no in-the-wild exploitation is currently known.

What to do: Upgrade Arcane to version 2.0.0 or later, which restores proper authorization on template operations. Until upgraded, restrict or review which accounts hold the default user role and audit existing compose templates (especially instance-wide defaults) for unexplained privileged settings or host path mounts that a low-privileged user may have injected.