Technical impact
Arcane permits unauthenticated remote users to supply a URL to the /api/templates/fetch endpoint. The application performs an HTTP GET to that URL without verifying the scheme or host and then returns the raw response to the requester. This lack of validation constitutes a server‑side request forgery flaw that gives an attacker the ability to query any resource reachable from the Arcane host, potentially leaking internal data or enabling further lateral movement.
Affected Systems
Any publicly exposed installation of Arcane from the getarcaneapp vendor running a version prior to 1.17.3 is susceptible. The vulnerability affects the /api/templates/fetch endpoint in the Arcane container‑management interface, which manages Docker resources. The fix is included in release 1.17.3 and later.
Risk and Exploitability
The CVSS base score of 7.2 indicates moderate‑to‑high severity; the reported exploitation likelihood is low, as indicated by the EPSS score of 1.525%, and the vulnerability is not catalogued in known exploit databases. Because the flaw is reachable over the public network without authentication or authorization, an attacker can simply craft a request to the endpoint to direct the server to any internal or external address. Absence of host or scheme checks makes exploitation trivial for a determined adversary, and the ability to retrieve raw responses provides a rich source of reconnaissance. The overall risk is therefore amplified by the lack of access controls and the sensitive nature of the data that may be accessible internally.
Github GHSA