CVE-2026-45625
Arcane, a tool for managing Docker containers and GitOps repositories, had a critical flaw that let any logged‑in user modify repository settings and steal stored Git credentials in a single request. The bug existed in all releases before 1.19.0 and was fixed in that version.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Arcane versions earlier than 1.19.0, used by Docker administrators and developers who manage GitOps repositories through its REST API.
Real-world impact
An attacker who can log into Arcane can change a repository URL to point to a malicious server and then trigger a test or file request. Arcane will send the stored personal access token or SSH key to the attacker’s server, giving them full access to the target Git repository.
Why this severity
The CVSS score of 9.9 reflects that the vulnerability is network‑based, requires only low effort, and allows an attacker with low privileges to gain complete confidentiality, integrity, and availability of the system by exfiltrating credentials.
What to do about it
- 01Upgrade Arcane to version 1.19.0 or later.
- 02Restart the Arcane service to ensure the new version is running.
NVD-referenced vendor advisory
Timeline
- May 29, 2026 · May 29, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 21, 2026 · 14d agoAdvisory updatedThe NVD record was last revised.
- Jul 21, 2026 · 14d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.