CVE-2026-23520
Published: 15 January 2026
Summary
CVE-2026-23520 is a critical-severity OS Command Injection (CWE-78) vulnerability in Arcane Arcane. Its CVSS base score is 9.0 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 26.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-6 (Least Privilege) and CM-5 (Access Restrictions for Change).
Deeper analysis
CVE-2026-23520 is a command injection vulnerability (CWE-78) in the updater service of Arcane, a modern Docker management tool, affecting versions prior to 1.13.0. The issue stems from the updater service's handling of lifecycle labels—specifically com.getarcaneapp.arcane.lifecycle.pre-update and com.getarcaneapp.arcane.lifecycle.post-update—which allow users to define commands to execute before or after a container update. These label values are passed directly to /bin/sh -c without any sanitization or validation, enabling arbitrary shell command execution. The vulnerability carries a CVSS v3.1 base score of 9.0 (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H).
Any authenticated user, not limited to administrators, can exploit this vulnerability by creating a project through the Arcane API and specifying a malicious command in one of the lifecycle labels. Exploitation occurs when an administrator triggers a container update—either manually or via scheduled update checks—at which point Arcane reads the label and executes the command inside the container. This grants the attacker arbitrary code execution within the container context, potentially leading to high confidentiality, integrity, and availability impacts, including full container compromise.
The vulnerability is addressed in Arcane version 1.13.0, as detailed in the project's security advisory (GHSA-gjqq-6r35-w3r8), release notes, associated pull request #1468, and fixing commit 5a9c2f92e11f86f8997da8c672844468f930b7e4. Security practitioners should upgrade to 1.13.0 or later and review projects for malicious lifecycle labels, particularly in environments with low-privilege API access.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-2738
Vulnerability details
Arcane provides modern docker management. Prior to 1.13.0, Arcane has a command injection in the updater service. Arcane’s updater service supported lifecycle labels com.getarcaneapp.arcane.lifecycle.pre-update and com.getarcaneapp.arcane.lifecycle.post-update that allowed defining a command to run before or after a container update. The…
more
label value is passed directly to /bin/sh -c without sanitization or validation. Because any authenticated user (not limited to administrators) can create projects through the API, an attacker can create a project that specifies one of these lifecycle labels with a malicious command. When an administrator later triggers a container update (either manually or via scheduled update checks), Arcane reads the lifecycle label and executes its value as a shell command inside the container. This vulnerability is fixed in 1.13.0.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE describes unauthenticated command injection via API labels passed to /bin/sh -c, directly enabling exploitation of the management application (T1190) for Unix shell command execution (T1059.004) inside containers.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires validation of untrusted lifecycle label inputs before passing them to /bin/sh -c, directly preventing command injection in the updater service.
Enforces least privilege to restrict project creation and lifecycle label setting via API to authorized users only, blocking low-privilege authenticated attackers.
Authorizes and restricts modifications to project configurations including executable lifecycle labels, preventing unauthorized injection during container updates.