Lucene search
+L

1 matches found

Github Security Blog
Github Security Blog
added 2026/04/30 8:55 p.m.22 views

Arcane Vulnerable to Unauthenticated Disclosure of Custom Compose Template Content (incl. `.env` secrets)

Summary Four GET endpoints under /api/templates in Arcane's Huma backend are registered without any Security requirement, allowing any unauthenticated network client to list and read the full Compose YAML and .env content of every custom template stored in the instance. Because Arcane's UI expose...

8.7CVSS5.5AI score0.0031EPSS
SaveExploits0References4Affected Software1
Rows per page
Query Builder