Critical 9.9 CVSS Flaw in Arcane Exposes GitOps Secrets to Basic Users

Arcane suffers a critical vulnerability (CVE-2026-45625, CVSS 9.9) where multiple GitOps REST endpoints fail to enforce admin checks, allowing any authenticated low-privileged user to read, modify, or delete repository configurations and to exfiltrate decrypted Git PATs/SSH keys by repointing repositories to attacker-controlled hosts; administrators are urged to upgrade to 1.19.0 immediately and rotate Git credentials if untrusted access occurred.