External risk intelligence

Arcane GitOps Credential Exfiltration Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-45625

Arcane is a management interface for Docker environments. Such management consoles are commonly deployed as web-based applications or services, often intended for access by administrators or users to manage container infrastructure, placing the API surface in a position where it is frequently reachable over the network in operational environments.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a critical security vulnerability in Arcane, a tool used to manage Docker environments. The issue allows any authenticated user to potentially steal sensitive Git credentials by manipulating how the system interacts with Git repositories. While Arcane is designed for administrative functions, this flaw means users with basic access could expose valuable credentials, impacting the security of code management.

Basic users can steal Git credentials.
This impacts code security and access controls.
Confirm if Arcane is used and assess exposure.

Attack Path

How an attacker could exploit the issue

An attacker with basic user access can exploit this vulnerability by manipulating Git repository configurations. By altering a repository's URL to point to an attacker-controlled server and omitting sensitive credential fields, the attacker can trick Arcane into exfiltrating plaintext Git credentials. This occurs when Arcane attempts to test or access branches/files for the modified repository, inadvertently sending the legitimate credentials to the attacker's host.

Logged-in user access required.
Repointing Git repository URL.
Plaintext Git credential exfiltration.

Live Threat

Current exploitation, exposure, and threat context

A logged-in user with the default user role could affect GitOps source repository configurations and stored credentials. When supported by the advisory, this vulnerability could enable a user to exfiltrate plaintext Git credentials by repointing an existing repository to an attacker-controlled host.

Stored Git credentials.
Exfiltrated via crafted API calls.
Plaintext credentials exposed to attacker.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Arcane application owner and platform team are likely responsible for addressing this vulnerability. The first practical step is to identify all Arcane instances, confirm their network reachability and business criticality, and then determine the accountable owner for remediation planning.

Assign ownership to application and platform teams.
Verify Arcane instances and their exposure.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Arcane?

Arcane is a management interface designed for Docker environments. Users and administrators rely on it to organize container images, networks, volumes, and GitOps source repositories. It simplifies the orchestration of containerized infrastructure by providing a centralized dashboard and API for these underlying resources.

What does CVE-2026-45625 mean for security?

This vulnerability is classified as Improper Authorization (CWE-862). It means the software fails to properly check if a user has administrative permissions before allowing them to manage Git repository settings. Because of this, regular users can perform actions—like modifying repository URLs—that should be restricted to administrators, leading to unauthorized access to sensitive configuration data.

How can an attacker trigger this vulnerability?

An attacker needs an active, authenticated account with basic user privileges. They trigger the flaw by changing a repository's URL to point to a server they control. If they omit existing credential fields during this update, Arcane will inadvertently send the legitimate Git credentials to the attacker's server the next time it tests the connection or browses the repository. Simply viewing a repository without triggering these specific actions will not cause the credentials to be sent.

Do I need to worry about this if my Arcane instance is internal?

According to Halo Surface Signal, Arcane is a management console often deployed as a web application intended for infrastructure administration. Even if your instance is internal, it likely maintains a wide network surface to allow access for various team members. Any internal user with basic credentials can exploit this, making it a relevant security concern regardless of whether the interface is reachable from the public internet.

How should I respond to this threat?

The most effective way to secure your environment is to update Arcane to version 1.19.0 or later, which resolves the authorization gap. Before applying the update, begin by inventorying all running instances to determine which systems are affected. Coordinate with your application and platform teams to confirm ownership and schedule the update as part of your standard maintenance workflow to prevent credential theft.

References

github.com/getarcaneapp/arcane/security/advisories/GHSA-7h26-hg4…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.