CVE-2026-96628

CVE-2026-96628 · Arcane: Environment access token bypasses the admin-required authorization gate on `/api/debug/pprof`

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.11.0, AuthMiddleware.managerAuth accepts X-Arcane-Agent-Token credentials and the environment-token branch calls next before the AdminRequired option is evaluated. An attacker with a valid X-Arcane-Agent-Token can request /api/debug/pprof/* through a route protected by WithAdminRequired because EnvironmentPermissionSet is installed and the request continues without checking IsGlobalAdmin. This exposes administrator-restricted Go pprof runtime and diagnostic information and may impose profiling overhead. This issue is fixed in version 2.11.0.

CVSS 4.3 · Medium · EPSS 0.2%

Published

2026-10-16T21:10:29.214Z

Updated

2026-10-19T16:40:50.253Z

Check your server →