Arcane Vulnerable to Unauthenticated Disclosure of Custom Compose Template Content (incl. `.env` secrets)
Date: 2026-04
Affected: go/github.com/getarcaneapp/arcane/backend
Attack vector: auth-bypass
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2026-42461
CWE: CWE-862

### Summary Four `GET` endpoints under `/api/templates*` in Arcane's Huma backend are registered without any `Security` requirement, allowing any unauthenticated network client to list and read the full Compose YAML and `.env` content of every custom template stored in the instance. Because Arcane's UI exposes a "Save as Template" flow on the project / swarm-stack creation pages that persists the operator's *real* env content (database passwords, API keys, etc.) verbatim, this missing authorization is an unauthenticated read of operator secrets in practice — not a theoretical info-disclosure. The frontend explicitly treats `/customize/templates/*` as an authenticated area (`PROTECTED_PREFIXES` in `frontend/src/lib/utils/redirect.util.ts`), and every CRUD operation (POST/PUT/DELETE) on the same paths requires a Bearer/API key, so this is a clear backend authorization gap, not intended public access. ### Details Affected file: `backend/internal/huma/handlers/templates.go:194-228`. In `RegisterTemplates`, four `huma.Register` calls have no `Security:` block: ```go // templates.go huma.Register(api, huma.Operation{ OperationID: "listTemplatesPaginated", Method: "GET", Path: "/templates", ... // <-- no Security }, h.ListTemplates) huma.Register(api, huma.Operation{ OperationID: "getAllTemplates", Method: "GET", Path: "/templates/all", ... }, h.GetAllTemplates) huma.Register(api, huma.Operation{ OperationID: "get


Mitigations:

Architectural layers (MAESTRO):