CVE-2026-45627: Arcane: Unauthenticated reflected XSS via SVG color parameter in /api/app-images/logo enables admin account takeover

Synopsis

A reflected cross-site scripting flaw in Arcane, a Docker management interface, lets unauthenticated attackers inject JavaScript through the color query parameter of the /api/app-images/logo endpoint. The endpoint reflects the parameter into an SVG style block without escaping, and because Arcane returns the response as image/svg+xml with no Content-Security-Policy, a logged-in admin lured to a crafted URL executes attacker code in Arcane's origin and the session cookie carries the request through to full admin takeover. A patched-image rebuild at Arcane 1.19.0 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker needs to reach the Arcane web interface over the network to deliver the crafted /api/app-images/logo URL.

• AuthenticationNot required

  The vulnerable endpoint is unauthenticated, so the attacker needs no Arcane credentials of their own.

• Victim interactionRequired

  A logged-in Arcane admin must be lured into clicking or navigating to the attacker's crafted URL for the injected script to execute.

• Attack complexityDetail

  Attack complexity is low: the parameter is reflected without escaping and no CSP or content-type protections need to be bypassed.

Blast Radius

• Attacker-controlled JavaScript runs in Arcane's origin under the victim admin's session.
• The HttpOnly JWT cookie is replayed by the browser, letting the attacker drive authenticated admin API calls.
• Full administrative control of Arcane follows, including manipulation of Docker containers, images, networks, and volumes managed by the instance.
• Confidential data visible to the admin (container configs, secrets surfaced in the UI, registry credentials) can be read and exfiltrated.