CVE-2026-45625 Security Alert: CRITICAL Vulnerability

Urgent: CVE-2026-45625 requires immediate attention.

· 7 min read

Executive Summary

CVE-2026-45625 is a critical authentication/authorization flaw in Arcane’s Git repository management API. The vulnerable Go package is github.com/getarcaneapp/arcane/backend. A logged-in user account can manage Git repository settings that should be admin-only, including listing, creating, updating, deleting, and testing repositories. In the most serious case, an attacker can repoint a stored repository URL to a server they control and trigger Arcane to decrypt and send stored Git credentials (PATs or SSH keys) to that attacker-controlled host.

Severity: Critical (CVSS 9.9)
KEV: No
Exploited in the wild: No

Immediate Action

  • Patch immediately to the first fixed release from the vendor. If you do not know the safe version yet, block deployment until you confirm it from the Arcane advisory or release notes: Arcane security advisory.
  • Restrict access to the Arcane UI/API to trusted users only. If possible, place it behind VPN, SSO, or an internal network segment.
  • Rotate all Git credentials stored in Arcane if any low-privilege user may have had access. Assume PATs and SSH keys may be exposed.
  • Review repository changes for unexpected URL edits, deletions, or test/branch/file access from non-admin accounts.
  • Temporarily disable repository management if your deployment allows feature flags or route blocking, until patched.
  • Preserve logs from Arcane and any Git server or web server receiving outbound requests for incident review.

Affected Versions

  • github.com/getarcaneapp/arcane/backend@<= TODO_VULNERABLE_VERSION vulnerable
  • github.com/getarcaneapp/arcane/backend@>= TODO_FIXED_VERSION safe

If you ship Arcane as a container image, treat all images built from vulnerable backend releases as affected until rebuilt from a fixed tag.

Resolution Guide

Go modules

go get github.com/getarcaneapp/arcane/backend@TODO_FIXED_VERSION
go mod tidy
go test ./...

JavaScript package managers if you consume Arcane-related tooling or wrappers that vendor the backend version indirectly:

npm install github.com/getarcaneapp/arcane/backend@TODO_FIXED_VERSION
yarn add github.com/getarcaneapp/arcane/backend@TODO_FIXED_VERSION
pnpm add github.com/getarcaneapp/arcane/backend@TODO_FIXED_VERSION

Python if packaged internally:

pip install --upgrade arcane-backend==TODO_FIXED_VERSION
pipx upgrade arcane-backend

Java if mirrored in an internal BOM or service wrapper:

mvn versions:use-dep-version -Dincludes=github.com.getarcaneapp:arcane-backend -DdepVersion=TODO_FIXED_VERSION
./gradlew dependencies

Linux package managers if your platform ships Arcane as a distro package:

apt-get update
apt-get install --only-upgrade arcane-backend
yum update arcane-backend
dnf update arcane-backend

Docker

docker pull TODO_VENDOR_IMAGE:TODO_FIXED_TAG
docker stop arcane
docker rm arcane
docker run -d --name arcane TODO_VENDOR_IMAGE:TODO_FIXED_TAG

Hardening / containment

# Example: block repository management routes at the reverse proxy until patched
location ~ ^/api/(customize/git-repositories|git-repositories/sync) {
    deny all;
}

Minimal code fix for maintainers: enforce admin checks on every repository handler, not just sync.

func (h *GitRepositoryHandler) UpdateRepository(ctx context.Context, input *UpdateGitRepositoryInput) (*UpdateGitRepositoryOutput, error) {
    if err := helpers.checkAdmin(ctx); err != nil {
        return nil, err
    }
    // existing logic...
}

Detection & Verification

Check your version against the fixed release once published. For Go projects:

go list -m all | grep github.com/getarcaneapp/arcane/backend

Look for the vulnerable code paths in your source tree or vendor directory:

grep -R "checkAdmin(ctx)" backend/internal/huma/handlers/git_repositories.go
grep -R "UpdateRepository(ctx" backend/internal/huma/handlers/git_repositories.go
grep -R "GetAuthConfig" backend/internal/services/git_repository_service.go

Verify exposure by confirming whether non-admin users can access these endpoints:

GET /api/customize/git-repositories
PUT /api/customize/git-repositories/{id}
POST /api/customize/git-repositories/{id}/test
GET /api/customize/git-repositories/{id}/branches
GET /api/customize/git-repositories/{id}/files

Verify the fix after upgrading:

# Non-admin requests should now return 403 Forbidden
curl -i -H "Authorization: Bearer $USER_TOKEN" \
  https://arcane.example/api/customize/git-repositories

# Admin-only actions should fail for normal users
curl -i -X PUT -H "Authorization: Bearer $USER_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"url":"https://example.invalid/repo.git"}' \
  https://arcane.example/api/customize/git-repositories/1

Audit logs for suspicious repository URL changes, repeated /test calls, or outbound connections to unknown hosts. If you see low-privilege users touching repository settings, treat it as a likely compromise.

Risk and Impact

This bug lets any authenticated user reach admin-level GitOps controls and, more importantly, trick Arcane into decrypting stored Git credentials and sending them to an attacker-controlled server. That can expose source code access, CI/CD secrets, and downstream production infrastructure tied to those credentials.

The blast radius is broad: attackers can alter repository URLs, delete repository configs, read private repo contents, and disrupt sync pipelines. Even without known wild exploitation, the impact is severe enough to justify emergency patching and credential rotation.

Keep reading