CVE-2026-96628

Deferred Deferred - Pending Action

Information Exposure via Go pprof in Arcane

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: GitHub, Inc.

Description

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.11.0, AuthMiddleware.managerAuth accepts X-Arcane-Agent-Token credentials and the environment-token branch calls next before the AdminRequired option is evaluated. An attacker with a valid X-Arcane-Agent-Token can request /api/debug/pprof/* through a route protected by WithAdminRequired because EnvironmentPermissionSet is installed and the request continues without checking IsGlobalAdmin. This exposes administrator-restricted Go pprof runtime and diagnostic information and may impose profiling overhead. This issue is fixed in version 2.11.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-16

Last Modified

2026-10-16

Generated

2026-10-17

AI Q&A

2026-10-17

EPSS Evaluated

N/A

NVD

CVE-2026-96628

Affected Vendors & Products

Vendor	Product	Version / Range
getarcaneapp	arcane	< 2.11.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability exists in Arcane, a Docker management interface, before version 2.11.0. The AuthMiddleware.managerAuth function improperly validates tokens, allowing attackers with a valid X-Arcane-Agent-Token to bypass admin restrictions. This lets them access /api/debug/pprof/* endpoints, which expose sensitive Go runtime and diagnostic data. The issue arises because the admin check is skipped when EnvironmentPermissionSet is installed.

Detection Guidance

Check if Arcane is running a version prior to 2.11.0 by running: docker ps | grep arcane. Inspect the Arcane container logs for unauthorized access attempts to /api/debug/pprof/* endpoints.

Impact Analysis

An attacker could exploit this to gather internal system information, including runtime details and profiling data. This may lead to further attacks or performance degradation due to profiling overhead. Systems using affected Arcane versions are at risk of unauthorized diagnostic access.

Compliance Impact

This vulnerability exposes administrator-restricted diagnostic information via the /api/debug/pprof/* endpoint. While not directly causing data breaches, unauthorized access to profiling data could potentially reveal sensitive system information, which may violate compliance requirements for data confidentiality under standards like GDPR or HIPAA if such data includes personal or health-related information.

Mitigation Strategies

Upgrade Arcane to version 2.11.0 or later immediately. If upgrading is not possible, restrict access to Arcane's API endpoints and disable debug endpoints in production environments.

Hi! I’m here to help you understand CVE-2026-96628. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70