Affected by GO-2026-5292
and 2 other vulnerabilities
GO-2026-5292: Arcane Backend: OS Command Injection in Volume Browser ListDirectory via path query parameter in github.com/getarcaneapp/arcane/backend
GO-2026-6806: Arcane: Environment access token bypasses the admin-required authorization gate on `/api/debug/pprof` in github.com/getarcaneapp/arcane/backend
GO-2026-6807: Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check) in github.com/getarcaneapp/arcane/backend