CVE-2026-96628

CVE-2026-96628 · Arcane: Environment access token bypasses the admin-required authorization gate on `/api/debug/pprof`

Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.11.0, AuthMiddleware.managerAuth accepts X-Arcane-Agent-Token credentials and the environment-token branch calls next before the AdminRequired option is evaluated. An attacker with a valid X-Arcane-Agent-Token can request /api/debug/pprof/* through a route protected by WithAdminRequired because EnvironmentPermissionSet is installed and the request continues without checking IsGlobalAdmin. This exposes administrator-restricted Go pprof runtime and diagnostic information and may impose profiling overhead. This issue is fixed in version 2.11.0.

CVSS 4.3 · Media · EPSS 0,2%

Publicación

2026-10-16T21:10:29.214Z

Actualización

2026-10-19T16:40:50.253Z

Comprueba tu servidor →