fkie_cve-2026-96628

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.11.0, AuthMiddleware.managerAuth accepts X-Arcane-Agent-Token credentials and the environment-token branch calls next before the AdminRequired option is evaluated. An attacker with a valid X-Arcane-Agent-Token can request /api/debug/pprof/* through a route protected by WithAdminRequired because EnvironmentPermissionSet is installed and the request continues without checking IsGlobalAdmin. This exposes administrator-restricted Go pprof runtime and diagnostic information and may impose profiling overhead. This issue is fixed in version 2.11.0.

GHSA-mp22-58ff-6fhr — Arcane: Environment access token bypasses the admin-required authorization gate on `/api/debug/pprof`

Affected: Go: github.com/getarcaneapp/arcane/backend/v2

## Summary

Arcane v2.10.2 contains an authorization inconsistency in `AuthMiddleware.managerAuth`.

When a request supplies a valid environment access token through the `X-Arcane-Agent-Token` header, `managerAuth` resolves the associated environment, installs an environment-scoped permission set, and immediately calls `next(c)`.

This occurs before the middleware evaluates the `AdminRequired` option and verifies that the caller is a global administrator.

As a result, an environment-scoped access token can access routes protected with `WithAdminRequired()`, despite the corresponding `EnvironmentPermissionSet` intentionally containing no global or sudo permissions.

In v2.10.2, the affected admin-only surface is the manager's Go `pprof` diagnostic interface under:

`/api/debug/pprof/*`

This exposes diagnostic and runtime profiling information that the application explicitly intends to restrict to global administrators.

The issue is an incorrect authorization vulnerability (CWE-863).

## Details

### 1. Environment access tokens are accepted by the manager authentication middleware

The production authentication middleware is configured with an environment access-token resolver:

`backend/internal/di/providers.go`

Conceptually, the middleware is constructed as:

```go auth.NewAuthMiddleware(authService, cfg). WithApiKeyValidator(apiKey). WithEnvironmentAccessTokenResolver(env). WithPermissionResolver(role) ```

Therefore, the `X-Arcane-Agent-Token` authenticati…

Most recent entries from all

fkie_cve-2026-96628

GHSA-mp22-58ff-6fhr — Arcane: Environment access token bypasses the admin-required authorization gate on `/api/debug/pprof`