Security Digest: May 23, 2026 - 2 Critical Vulnerabilities

Two high-severity flaws disclosed today can let authenticated low-privilege users break core trust boundaries: one in Arcane can let a non-admin overwrite global deployment variables for every project, and one in Nezha can let a member user read internal HTTP response bodies through the dashboard.

· 6 min read

Executive Summary

Two high-severity flaws disclosed today can let authenticated low-privilege users break core trust boundaries: one in Arcane can let a non-admin overwrite global deployment variables for every project, and one in Nezha can let a member user read internal HTTP response bodies through the dashboard. If you run either product, treat this as an immediate patch-and-audit event.

Arcane deployments are at risk of cross-project supply-chain compromise and environment poisoning. Nezha operators should assume member accounts can be abused to probe internal services and leak response content unless the notification routes are locked down and patched.

Critical Vulnerabilities

CVE-2026-47125: Arcane global environment write bypass

  • Impact: Any authenticated non-admin user can overwrite the system-wide .env.global file used in every project deployment. That can redirect image pulls to attacker-controlled registries, alter database endpoints, leak secrets, or disrupt all projects on the host.
  • Affected Systems: github.com/getarcaneapp/arcane/backend (all versions exposing PUT /api/environments/{id}/templates/variables without admin checks).
  • Immediate Action: Patch immediately and block non-admin access to the global variables endpoint at the API gateway or reverse proxy until fixed. Review recent changes to .env.global and redeploy any affected projects.
  • Mitigation: Enforce admin authorization in the handler, rotate any secrets that may have been overwritten, and verify compose files have not been pointed at attacker-controlled registries. Watch for unexpected registry, image, or database variable changes.

Why this matters now: This is not a simple config bug. It can become cross-project supply-chain RCE if deployments pull attacker-controlled images, and the impact spans every project sharing the global environment file.

CVE-2026-46717: Nezha notification routes expose internal HTTP responses

  • Impact: A RoleMember user can create or update notifications that trigger server-side HTTP requests and reflect the full non-2xx response body back to the caller. That enables internal service probing, response-body leakage, and memory exhaustion via large responses.
  • Affected Systems: github.com/nezhahq/nezha dashboard builds at commit 50dc8e660326b9f22990898142c58b7a5312b42a and earlier on master.
  • Immediate Action: Restrict notification route access now and patch to move /api/v1/notification and /api/v1/notification/:id behind admin-only authorization. Assume any member account can be used for SSRF-style probing until fixed.
  • Mitigation: Enforce adminHandler on the notification routes, cap response bodies, and block requests to private, loopback, and link-local ranges. Review logs for suspicious notification URLs targeting internal IPs or metadata endpoints.

Why this matters now: Even though the severity is “high,” the practical risk is immediate: a low-privilege dashboard user can turn the platform into a relay for internal reconnaissance and data leakage.

Previously Alerted

What to Do Now

  1. Patch or disable exposure immediately for Arcane and Nezha if updates are not yet available.
  2. Verify authorization controls on the Arcane global variables endpoint and Nezha notification routes; confirm non-admin/member users cannot reach them.
  3. Audit recent activity for changes to global env files, unexpected compose substitutions, notification URLs, and outbound requests to internal IPs or metadata services.
  4. Rotate secrets if there is any chance Arcane’s global variables were modified or Nezha was used to probe internal systems.
  5. Contain blast radius by limiting which systems can reach internal services, registries, and metadata endpoints from the application host.

Verification steps:

  • Check whether PUT /api/environments/{id}/templates/variables is blocked for non-admin users.
  • Confirm /api/v1/notification and /api/v1/notification/:id require admin privileges.
  • Search logs for requests to private IP ranges, 169.254.169.254, and unexpected registry hosts.

Monitoring recommendations:

  • Alert on changes to .env.global and any redeploys that follow them.
  • Watch for outbound traffic from Arcane or Nezha to internal networks and cloud metadata services.
  • Track failed notification requests with large response bodies or repeated internal URL targets.

Related Resources

  • Internal blog posts: A follow-up analysis on global environment poisoning and dashboard SSRF hardening should be published separately.
  • Official vendor advisories: Monitor the Arcane and Nezha security channels and release notes for patched builds and configuration guidance.

Keep reading