CVE-2026-40242

creationtimestamp| type| source ---|---|--- 2026-04-10 22:32:43+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mj6ev3mnrn2o 2026-04-10 23:27:06+00:00| published-proof-of-concept| Telegram/azLV8BVN7oG3TROgln-jCTMw5r1pt6lKfNlckhfBfrofK-k 2026-04-17 03:03:48+00:00| confirmed|...

CVE-2026-40242

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 1.17.3, the /api/templates/fetch endpoint accepts a caller-supplied url parameter and performs a server-side HTTP GET request to that URL without authentication and without URL scheme or host validation...