CVE-2026-40242: Arcane Unauthenticated SSRF with Conditional Response Reflection in Template Fetch Endpoint

Vulnerability summary

CVE-2026-40242 is a high (CVSS 7.2) Server-Side Request Forgery vulnerability in getarcane arcane. EPSS estimates a 0.62% chance of exploitation in the next 30 days, higher than 49.8% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 10-04-2026
   PublishedVulnerability first disclosed.
2. 13-04-2026
   Last modifiedVulnerability information updated.

Description

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 1.17.3, the /api/templates/fetch endpoint accepts a caller-supplied url parameter and performs a server-side HTTP GET request to that URL without authentication and without URL scheme or host validation. The server's response is returned directly to the caller. type. This constitutes an unauthenticated SSRF vulnerability affecting any publicly reachable Arcane instance. This vulnerability is fixed in 1.17.3.

• CWE-918Server-Side Request ForgeryThe web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.