CVE-2026-96628
CVE-2026-96628 · Arcane: Environment access token bypasses the admin-required authorization gate on `/api/debug/pprof`
Diese Seite enthält Fakten aus öffentlichen Sicherheitsquellen. Lesen Sie vor dem Aktualisieren die Originalmeldung.
Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.11.0, AuthMiddleware.managerAuth accepts X-Arcane-Agent-Token credentials and the environment-token branch calls next before the AdminRequired option is evaluated. An attacker with a valid X-Arcane-Agent-Token can request /api/debug/pprof/* through a route protected by WithAdminRequired because EnvironmentPermissionSet is installed and the request continues without checking IsGlobalAdmin. This exposes administrator-restricted Go pprof runtime and diagnostic information and may impose profiling overhead. This issue is fixed in version 2.11.0.
CVSS 4.3 · Mittel · EPSS 0,2%
- Veröffentlicht
- Aktualisiert
Betroffene Produkte und Versionen
arcane
- Softwareversionen
- < 2.11.0: Betroffen
Keine Korrektur veröffentlicht
Originalquellen
- https://github.com/getarcaneapp/arcane/security/advisories/GHSA-mp22-58ff-6fhr
- https://github.com/getarcaneapp/arcane/pull/3881
- https://github.com/getarcaneapp/arcane/commit/4fe4c7ed9483dff7d43e3c4bee6a92037ce886b4
- https://github.com/getarcaneapp/arcane/releases/tag/backend/v2.11.0
- https://nvd.nist.gov/vuln/detail/CVE-2026-96628