CVE-2026-96628 Details
Description
Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.11.0, AuthMiddleware.managerAuth accepts X-Arcane-Agent-Token credentials and the environment-token branch calls next before the AdminRequired option is evaluated. An attacker with a valid X-Arcane-Agent-Token can request /api/debug/pprof/* through a route protected by WithAdminRequired because EnvironmentPermissionSet is installed and the request continues without checking IsGlobalAdmin. This exposes administrator-restricted Go pprof runtime and diagnostic information and may impose profiling overhead. This issue is fixed in version 2.11.0.
A vulnerability in Arcane's authentication middleware for managing Docker environments allows environment access tokens to bypass admin authorization requirements. This issue, present in versions prior to 2.11.0, enables unauthorized access to the application's Go pprof diagnostic interface, which is intended for global administrators only. The vulnerability arises because the middleware processes environment tokens before evaluating admin rights, creating an inconsistency that could be exploited to access sensitive runtime information and diagnostic tools.
Users can update to Arcane version 2.11.0 or later, where this vulnerability has been fixed. In addition, as a defense in depth, it is recommended to restrict access to the pprof endpoints to only those authentication mechanisms that can represent a global administrator.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 16, 2026CISA-ADP
Assessed Oct 19, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/getarcaneapp/arcane/commit/4fe4c7ed9483dff7d43e3c4bee6a92037ce886b4 | [email protected] | Source CodeVendor |
| https://github.com/getarcaneapp/arcane/pull/3881 | [email protected] | Issue TrackingVendor |
| https://github.com/getarcaneapp/arcane/releases/tag/backend/v2.11.0 | [email protected] | Release NotesVendor |
| https://github.com/getarcaneapp/arcane/security/advisories/GHSA-mp22-58ff-6fhr | [email protected] | AdvisoryExploitRemedyTechnical AnalysisVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Arcane | 2.10.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 19, 2026 | CVE Modified | CISA-ADP |
| Oct 16, 2026 | New CVE Received | [email protected] |