CVE-2026-23944
Published: 19 January 2026
Summary
CVE-2026-23944 is a high-severity Missing Authentication for Critical Function (CWE-306) vulnerability in Arcane Arcane. Its CVSS base score is 8.0 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 35.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and AC-3 (Access Enforcement).
Deeper analysis
CVE-2026-23944 is a critical authentication bypass vulnerability (CWE-306) in Arcane, an interface for managing Docker containers, images, networks, and volumes. In versions prior to 1.13.2, the environment proxy middleware processes requests to `/api/environments/{id}/...` endpoints for remote environments before enforcing authentication. If the environment ID is not local, the middleware proxies the request to the remote agent and attaches the manager-held agent token, even for unauthenticated callers. This flaw allows unauthenticated access to remote environment operations, such as listing containers, streaming logs, or other agent endpoints. The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
An unauthenticated attacker with network access to the Arcane manager can exploit this by sending requests to remote environment endpoints. Successful exploitation grants full access to remote environment resources via the proxy, enabling actions like data exposure, unauthorized modifications to containers or volumes, and service disruptions. No privileges, user interaction, or special conditions are required beyond reaching the exposed Arcane instance.
The vulnerability is patched in Arcane version 1.13.2, which enforces authentication before proxying remote environment requests. Security practitioners should upgrade to this version immediately. Additional details are available in the GitHub security advisory (GHSA-2jv8-39rp-cqqr), the patching commit (2008e1b93b25d0c4c3fff3af07843766231614eb), pull request #1532, and the release notes for v1.13.2.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-3280
Vulnerability details
Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to version 1.13.2, unauthenticated requests could be proxied to remote environment agents, allowing access to remote environment resources without authentication. The environment proxy middleware handled `/api/environments/{id}/...` requests…
more
for remote environments before authentication was enforced. When the environment ID was not local, the middleware proxied the request and attached the manager-held agent token, even if the caller was unauthenticated. This enabled unauthenticated access to remote environment operations (e.g., listing containers, streaming logs, or other agent endpoints). An unauthenticated attacker could access and manipulate remote environment resources via the proxy, potentially leading to data exposure, unauthorized changes, or service disruption. Version 1.13.2 patches the vulnerability.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE enables exploitation of a public-facing Docker management web interface (T1190) for unauthenticated access to remote container listing/discovery (T1613) and administration operations like logs, modifications, disruptions (T1609).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prohibits unauthenticated actions such as proxying requests to remote environment endpoints, addressing the core authentication bypass vulnerability.
Enforces approved authorizations for access to remote environment resources via the proxy middleware before processing requests.
Establishes and enforces authentication and usage restrictions for proxied remote access to environment agents and their resources.