Arcane environment token bypasses admin check on pprof endpoint
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-863.
Summary
Arcane versions before 2.11.0 are affected. An authorization flaw (CWE-863) lets a request authenticated with an environment token pass a check that should require a global administrator. An attacker with a valid environment token can reach the Go pprof debug endpoints under /api/debug/pprof, which expose administrator-restricted runtime and diagnostic information and may add profiling overhead.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.11.0, AuthMiddleware.managerAuth accepts X-Arcane-Agent-Token credentials and the environment-token branch calls next before the AdminRequired option is evaluated. An attacker with a valid X-Arcane-Agent-Token can request /api/debug/pprof/* through a route protected by WithAdminRequired because EnvironmentPermissionSet is installed and the request continues without checking IsGlobalAdmin. This exposes administrator-restricted Go pprof runtime and diagnostic information and may impose profiling overhead. This issue is fixed in version 2.11.0.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| getarcaneapp | arcane | before 2.11.0 | 2.11.0 | Patch available | CNA |
| — | github.com/getarcaneapp/arcane/backend/v2 (Go) | before 2.11.0 | 2.11.0 | Patch available | GHSA-mp22-58ff-6fhr |
- arcane Vendorgetarcaneapp Affected before 2.11.0 Fixed in 2.11.0 Patch available CNA
- github.com/getarcaneapp/arcane/backend/v2 (Go) Vendor— Affected before 2.11.0 Fixed in 2.11.0 Patch available GHSA-mp22-58ff-6fhr
Remediation
Update the Go module github.com/getarcaneapp/arcane/backend/v2 to version 2.11.0, which fixes the flaw. The sources list no fixed version for arcane.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
- Fix · CNA arcane (getarcaneapp) Fixed in 2.11.0
- Fix · GHSA-mp22-58ff-6fhr github.com/getarcaneapp/arcane/backend/v2 (Go) Fixed in 2.11.0 Advisory →
Timeline
- 2026-10-18 Threatist record created from CVE-2026-96628
- 2026-10-18 Alias added: GHSA-mp22-58ff-6fhr
- 2026-10-18 Fix available: Go/github.com/getarcaneapp/arcane/backend/[email protected] · GHSA-mp22-58ff-6fhr
- 2026-10-18 CVSS score added · GHSA-mp22-58ff-6fhr
- 2026-10-18 Weakness changed · GHSA-mp22-58ff-6fhr
- 2026-10-18 5 new references · GHSA-mp22-58ff-6fhr
- 2026-10-19 CISA SSVC decision points changed
References
Other 5
- https://github.com/getarcaneapp/arcane/security/advisories/GHSA-mp22-58ff-6fhr
- https://github.com/getarcaneapp/arcane/pull/3881
- https://github.com/getarcaneapp/arcane/commit/4fe4c7ed9483dff7d43e3c4bee6a92037ce886b4
- https://github.com/getarcaneapp/arcane/releases/tag/backend/v2.11.0
- https://github.com/getarcaneapp/arcane
More getarcaneapp vulnerabilities
- TI-2026-33369 Missing authorization in getarcaneapp arcane CVSS 3.1CRITICAL 9.9
- TI-2026-75557 Arcane users with delegated permission can take over admin accounts CVSS 3.1HIGH 8.8
- TI-2026-34717 Arcane: Missing admin authorization on global variables endpoint CVSS 3.1HIGH 8.8
- TI-2026-75556 Credential exfiltration in Arcane via registry URL repointing CVSS 3.1HIGH 8.5
- TI-2026-33371 Arcane: Unauthenticated reflected XSS via SVG color parameter in /api/app-images/logo enables admin account takeover CVSS 3.1HIGH 8.2
- TI-2026-34768 Arcane: Authenticated Arbitrary Host File Read via Docker Compose Include Directives in Arcane CVSS 3.1HIGH 7.7
Sources
- CVE-2026-96628 · CVE Program
- CVE-2026-96628 · NVD
- FIRST EPSS
- GHSA-mp22-58ff-6fhr · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences