Is CVE-2026-40242 actively exploited?

A proof-of-concept exploit is publicly available for CVE-2026-40242, but active exploitation has not been confirmed.

Can CVE-2026-40242 be exploited remotely?

Yes. CVE-2026-40242 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-40242?

CVE-2026-40242 has a CVSS score of 7.2 (HIGH).

HOME VULNERABILITIESCVE-2026-40242

HIGHPOC

CVE-2026-40242

CWE-918Published: April 10, 2026· Updated: Apr 13, 2026

7.2

CVSS v3.1

Official Description

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 1.17.3, the /api/templates/fetch endpoint accepts a caller-supplied url parameter and performs a server-side HTTP GET request to that URL without authentication and without URL scheme or host validation. The server's response is returned directly to the caller. type. This constitutes an unauthenticated SSRF vulnerability affecting any publicly reachable Arcane instance. This vulnerability is fixed in 1.17.3.

NVD Source

Technical Analysis

CVE-2026-40242 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

The vulnerability has a "Changed" scope, meaning successful exploitation can impact components beyond the vulnerable component itself — such as the host operating system or adjacent services.

A proof-of-concept (PoC) exploit exists for CVE-2026-40242. While not yet confirmed in active campaigns, the availability of PoC code increases exploitation risk substantially.