Arcane, a Docker management interface, allowed unauthorized requests to be forwarded to remote environment agents before authentication was applied. The flaw let an attacker reach agent endpoints such as container listings, log streams, and other management actions without credentials. This could expose sensitive data, permit malicious changes, or disrupt services, representing a critical lack of permission checks (CWE-306).

The vulnerability affects the Arcane platform prior to version 1.13.2. Any deployment of Arcane older than this release is susceptible.

The CVSS base score is 8.0, indicating a high severity, while the EPSS score is below 1 %, suggesting a low probability of exploitation in the wild. It is not featured in the CISA KEV catalog. The flaw can be triggered by sending HTTP requests to /api/environments/{id}/… on an unprotected Arcane instance, and the unauthenticated caller’s request is proxied to the remote environment with the agent token, thereby bypassing authentication controls.