CVE-2026-23520

CVE-2026-23520 is a high-severity command injection vulnerability affecting Arcane Docker management software prior to version 1.13.0. It allows authenticated, non-administrative users to execute arbitrary shell commands within containers by crafting malicious lifecycle labels that are unsanitized and executed by the updater service. With a CVSS score of 8.0, this flaw presents a significant risk of full compromise (confidentiality, integrity, availability) once an administrator triggers an update. While there is no evidence of active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered considerable community discussion, indicating awareness among security researchers.