Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 1.19.0, the unauthenticated GET /api/app-images/logo endpoint reflects a user-supplied color query parameter into the body of an SVG document via strings.ReplaceAll with no escaping. The substitution lands inside a <style> element of the embedded logo.svg, allowing an attacker to close the style block and inject executable <script> content. Because the response is served as image/svg+xml and Arcane sets no Content-Security-Policy or X-Content-Type-Options headers, navigating a logged-in admin victim to a crafted URL executes attacker-controlled JavaScript in Arcane's origin and rides the victim's HttpOnly JWT cookie to fully compromise the admin account. This vulnerability is fixed in 1.19.0.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-05-31 | 2 | Disclosure1General1 |
| 2026-06-17 | 1 | Disclosure1 |
CVE-2026-45627 Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 1.19.0, the unauthenticated GET /api/app-images/logo endpoint reflects … https://www.cve.org/CVERecord?id=CVE-2026-45627
Post summary
A brief disclosure of an unauthenticated reflection vulnerability in Arcane's Docker management interface, with no PoC, exploit, or patch details provided.
CVE-2026-45627 Arcane 1.19.0以前の脆弱性をわかりやすく解説｜影響範囲と対策まとめ https://www.cybernote.click/2026/06/13/cve-2026-45627-arcane-1190/ #IT #Security #cybersecurity
Post summary
A Japanese blog post explains CVE-2026‑45627 affecting Arcane versions prior to 1.19.0, covering its scope and offering countermeasures, but it does not provide exploits, PoC, or active exploitation evidence.
🚨*CVE* CVE-2026-45627 Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 1.19.0, the unauthenticated GET /api/app-images/logo endpoint reflects … https://www.cve.org/CVERecord?id=CVE-2026-45627 ----- Traducción: CVE-2026-45627 Arc… http://infoflow.cloud`
Post summary
A brief disclosure of CVE-2026-45627 highlights an unauthenticated reflected endpoint in Arcane, with no PoC, exploit, or patch information provided.