CVE-2026-45625: Arcane: Missing admin authorization on git repository endpoints allows non-admin users to exfiltrate stored Git credentials and tamper with GitOps configs
Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 1.19.0, Arcane's huma-based REST API exposes nine endpoints under /api/customize/git-repositories and /api/git-repositories/sync for managing GitOps source repositories and their stored credentials. Eight of those endpoints (list, create, get, update, delete, test, listBranches, browseFiles) never call the checkAdmin(ctx) helper that every other admin-managed resource (container registries, environments, users, API keys, swarm, settings, system, notifications, events) uses, and the huma authentication middleware deliberately enforces only authentication, not the admin role. As a result, any logged-in user with the default user role can list, create, modify, delete, and test git repository configurations. By repointing an existing repository's URL to an attacker-controlled host while omitting the token/sshKey fields (which UpdateRepository only rewrites when explicitly supplied), the attacker causes Arcane to decrypt the legitimate PAT/SSH key on its next /test, /branches, or /files call and present it as HTTP Basic auth (or SSH key auth) to the attacker's host — producing a one-step exfiltration of plaintext Git credentials. This vulnerability is fixed in 1.19.0.
HarborGuard Analysis
HarborGuard analysisSynopsis
This is a missing authorization flaw in Arcane, a Docker management interface. The bug lets any authenticated low-privilege user reach eight git-repository management endpoints that should be admin-only, because the huma REST API skips the checkAdmin helper used by every other administrative resource. Successful exploitation lets a non-admin repoint a stored repository to an attacker-controlled host so Arcane decrypts and replays its stored Git personal-access tokens or SSH keys, yielding one-step credential exfiltration plus full tamper of GitOps configuration. A patched-image rebuild at Arcane 1.19.0 is available on HarborGuard for affected environments.
HarborGuard Coverage
Detection is available across every HarborGuard environment: the CVE is ingested from upstream feeds within minutes of publication and matched against Arcane images in customer registries and CI pipelines, including custom-built images that embed Arcane below 1.19.0.
AvailableTriage is available with the published CVSS score of 9.9 (Critical) applied and then reweighted against each customer org's compliance policy, so internet-exposed or multi-tenant Arcane deployments escalate faster than isolated ones. Findings route to the inbox configured for container-platform and GitOps ownership inside each customer org.
AvailableA patched-image rebuild at Arcane 1.19.0 becomes available on HarborGuard once the fixed upstream image is ingested. For customers who opt into auto-remediation, the rebuild is produced, a regression test run is executed, and a pull request is opened against workloads that reference an affected Arcane version.
Pending upstreamExploit Conditions
- Network reachabilityRequired
The attacker must reach the Arcane REST API over the network (AV:N), so any exposure beyond the host loopback is in scope.
- AuthenticationRequired
PR:L means the attacker needs a logged-in Arcane account, but any default user-role account is sufficient; no admin role is required.
- Victim interactionNot required
UI:N: the attacker drives the repoint and the subsequent /test, /branches, or /files call directly via the API with no admin or user action.
- Attack complexityDetail
AC:L: the exploit is a reliable sequence of authenticated API calls with no race conditions or environmental preconditions.
Blast Radius
- Reads plaintext Git personal-access tokens and SSH private keys that Arcane had stored encrypted, by forcing Arcane to present them as HTTP Basic or SSH auth to an attacker-controlled host.
- Modifies GitOps source configuration: repository URLs, branches, and file paths that downstream deployments pull from, enabling supply-chain tampering of anything Arcane reconciles.
- Deletes or replaces existing repository entries, disrupting GitOps reconciliation and the container, image, network, and volume workflows that depend on it.
- Pivots with the stolen Git credentials into the upstream source-control account, expanding impact well beyond the Arcane host.
How HarborGuard Handles This
Available on HarborGuard: ingestion of the Arcane 1.19.0 fixed image, a rebuild of any downstream image that pins an affected version, and a pull request opened against affected workloads for customers who opt into auto-remediation. Median time from CVE publication to merged patch PR for critical-severity issues like this one is around 90 minutes in environments with auto-remediation enabled. Where compliance policy delays automated merges, HarborGuard surfaces compensating controls in the finding: restrict the Arcane API to admin users at the ingress or reverse proxy, rotate every Git PAT and SSH key currently stored in Arcane (treat them as disclosed), and audit recent repository create, update, test, branches, and files calls for non-admin actors and unexpected URL changes.
Metrics
- CVSS v3.1
- 9.9
- Severity
- CRITICAL
- Fixed in
- —
- Affected Products
- 1
- getarcaneapp / arcane< 1.19.0
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H