An unauthenticated SSRF vulnerability in the Arcane container management interface allows remote attackers to perform unauthorized requests, posing a significant risk to internal network security.

The application fails to validate the URL parameter provided to the /api/templates/fetch endpoint, allowing unauthenticated users to force the server to perform arbitrary GET requests. This Server-Side Request Forgery (SSRF) vulnerability permits attackers to probe internal services or interact with external resources as the server.

Successful exploitation of this vulnerability can lead to unauthorized access to internal network resources that are otherwise protected by firewalls. Given the CVSS score of 7.2, this high-severity flaw could facilitate data exfiltration or internal service disruption, directly impacting the confidentiality and integrity of the organization's backend infrastructure.

Immediate Action: Upgrade the Arcane installation to version 1.17.3 or later to include the necessary URL validation logic.

Proactive Monitoring: Review web server access logs for anomalous requests to the /api/templates/fetch endpoint, particularly those containing internal IP addresses or sensitive local ports.

Compensating Controls: Implement strict network egress filtering on the server hosting Arcane to prevent unauthorized requests to internal resources and restrict access to the Arcane management interface via a VPN or IP allowlist.

Public Exploit Available: No (A Nuclei detection template exists, but there is no confirmed weaponized exploit or published public PoC).

The severity of this SSRF vulnerability necessitates an immediate upgrade to version 1.17.3. Organizations should treat this as a high-priority task, as the unauthenticated nature of the attack vector allows for trivial exploitation by remote actors. If an immediate update is not feasible, restrict access to the Arcane interface immediately until a patch can be applied.