Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 1.19.2, the PUT /api/environments/{id}/templates/variables endpoi…

Arcane, a Docker container management interface, contains a critical authorization bypass vulnerability in version prior to 1.19.2. The PUT /api/environments/{id}/templates/variables endpoint lacks proper admin authorization checks, allowing any authenticated non-admin user to overwrite global environment variables. Attackers can exploit this to redirect image pulls to malicious registries, enabling supply-chain attacks and remote code execution on Docker hosts. The vulnerability also allows credential exfiltration and service disruption across all projects. This represents a significant supply chain risk in containerized environments.