Vulnerability-Lookup

GHSA-MP22-58FF-6FHR

Vulnerability from github – Published: 2026-10-16 21:12 – Updated: 2026-10-16 21:12

Summary

Arcane: Environment access token bypasses the admin-required authorization gate on `/api/debug/pprof`

Details

Summary

Arcane v2.10.2 contains an authorization inconsistency in AuthMiddleware.managerAuth.

When a request supplies a valid environment access token through the X-Arcane-Agent-Token header, managerAuth resolves the associated environment, installs an environment-scoped permission set, and immediately calls next(c).

This occurs before the middleware evaluates the AdminRequired option and verifies that the caller is a global administrator.

As a result, an environment-scoped access token can access routes protected with WithAdminRequired(), despite the corresponding EnvironmentPermissionSet intentionally containing no global or sudo permissions.

In v2.10.2, the affected admin-only surface is the manager's Go pprof diagnostic interface under:

/api/debug/pprof/*

This exposes diagnostic and runtime profiling information that the application explicitly intends to restrict to global administrators.

The issue is an incorrect authorization vulnerability (CWE-863).

Details

1. Environment access tokens are accepted by the manager authentication middleware

The production authentication middleware is configured with an environment access-token resolver:

backend/internal/di/providers.go

Conceptually, the middleware is constructed as:

auth.NewAuthMiddleware(authService, cfg).
    WithApiKeyValidator(apiKey).
    WithEnvironmentAccessTokenResolver(env).
    WithPermissionResolver(role)

Therefore, the X-Arcane-Agent-Token authentication path is active in the production manager.

2. The environment-token path returns before authorization options are evaluated

The relevant logic is in:

backend/internal/auth/middleware.go

managerAuth first checks the X-Arcane-Agent-Token header.

When the token resolves to an environment, the middleware installs an environment-scoped permission set and immediately continues processing:

if agentToken := req.Header.Get(utils.HeaderAgentToken); agentToken != "" {
    if env, ok := m.resolveEnvironmentAccessToken(ctx, agentToken).Get(); ok {
        environmentScopedInternal(c, env)
        return next(c)
    }
}

The important part is the unconditional:

return next(c)

The normal authentication path later evaluates the middleware's AdminRequired option:

ps := m.resolvePermissionsOrDeny(ctx, user)

if m.options.AdminRequired && !ps.IsGlobalAdmin() {
    return c.JSON(http.StatusForbidden, common.APIError{
        Code:    "FORBIDDEN",
        Message: "You don't have permission to access this resource",
    })
}

The environment-token branch never reaches this check.

Consequently, WithAdminRequired() has no effect when authentication succeeds through a valid environment access token.

This creates an authorization inconsistency between authentication mechanisms:

normal user/session authentication → AdminRequired is enforced;
environment access-token authentication → AdminRequired is bypassed.

3. Environment tokens are intentionally not global-administrator credentials

backend/pkg/authz/permission_set.go defines the effective permissions assigned to an environment access token.

EnvironmentPermissionSet(envID) grants environment-scoped permissions only for the specified environment:

func EnvironmentPermissionSet(envID string) *PermissionSet {
    ps := NewPermissionSet()

    if envID == "" {
        return ps
    }

    for _, p := range AllPermissions() {
        if IsEnvScoped(p) {
            ps.AddEnv(envID, p)
        }
    }

    return ps
}

The implementation explicitly establishes that these credentials do not receive global or sudo permissions.

Therefore, an environment access token should not satisfy a global-administrator authorization requirement.

The early return in managerAuth bypasses this intended privilege boundary.

4. `/api/debug/pprof/*` explicitly requires global-administrator authorization

The diagnostic routes are registered in:

backend/api/ws/diagnostics.go

The pprof group is protected using:

pprofGroup := group.Group(
    "/debug/pprof",
    authMiddleware.WithAdminRequired().Add(),
)

The source also documents the intended authorization requirement by noting that pprof keeps the stricter admin-required gate.

The group exposes handlers including:

/api/debug/pprof/
/api/debug/pprof/cmdline
/api/debug/pprof/profile
/api/debug/pprof/symbol
/api/debug/pprof/trace
/api/debug/pprof/heap
/api/debug/pprof/goroutine
/api/debug/pprof/allocs
/api/debug/pprof/block
/api/debug/pprof/mutex
/api/debug/pprof/threadcreate

Named profiles are dispatched through pprof.Handler.

Because WithAdminRequired() is bypassed by the environment-token branch, a valid environment access token can reach these handlers even though its permission set is not globally privileged.

5. Other middleware does not restore the missing authorization check

The CSRF middleware recognizes X-Arcane-Agent-Token as a header-based credential and does not apply the normal cross-origin CSRF validation to such requests.

Additionally, the environment proxy middleware passes through requests that do not target an /environments/{id}/... path.

Therefore a request to:

/api/debug/pprof/*

can proceed to managerAuth, enter the environment-token authentication branch, and reach the pprof handler without another global-administrator authorization check being applied.

Source-to-sink authorization path

The vulnerable control flow is:

X-Arcane-Agent-Token
        |
        v
environment access token resolver
        |
        v
environment resolved successfully
        |
        v
EnvironmentPermissionSet(environmentID)
        |
        v
return next(c)
        |
        |  AdminRequired check is skipped
        v
/api/debug/pprof/*
        |
        v
net/http/pprof handler

The security boundary violation occurs at the early return next(c).

Proof of Concept

Preconditions

The test requires:

A valid Arcane environment access token.
An Arcane manager running the affected code.
No global-administrator account or credentials.

Test 1 — environment access token

Send a request to an admin-protected pprof endpoint using only an environment access token:

GET /api/debug/pprof/heap?debug=1 HTTP/1.1
Host: arcane.example.com
X-Arcane-Agent-Token: <VALID_ENVIRONMENT_ACCESS_TOKEN>

No administrator session cookie or administrator Bearer token is supplied.

Vulnerable behavior

On an affected instance, the request is expected to reach the pprof handler instead of being rejected by WithAdminRequired().

A successful response demonstrates that the environment-token authentication branch bypasses the administrator requirement.

For example, the response may contain the Go heap profiling output generated by net/http/pprof.

Test 2 — non-admin user contrast case

Send the same request using a normal authenticated non-global-admin user:

GET /api/debug/pprof/heap?debug=1 HTTP/1.1
Host: arcane.example.com
Authorization: Bearer <NON_ADMIN_ACCESS_TOKEN>

The expected result is:

HTTP/1.1 403 Forbidden

with an authorization error indicating that the user does not have permission to access the resource.

This contrast demonstrates the authorization inconsistency:

environment-scoped token
        -> admin gate skipped
        -> pprof handler reached

normal non-admin user
        -> admin gate evaluated
        -> HTTP 403

Expected secure behavior

A valid environment access token should receive:

HTTP/1.1 403 Forbidden

for every route protected with WithAdminRequired().

Only a caller whose effective permission set satisfies IsGlobalAdmin() should be allowed to access these routes.

Impact

An attacker who obtains a valid environment access token can cross the intended authorization boundary between an individual environment and manager-wide administrative functionality.

In the currently identified route configuration, this allows unauthorized access to the manager's Go pprof diagnostic endpoints.

Depending on the requested profile, these endpoints can expose internal runtime and diagnostic information such as:

goroutine stack traces;
function and package names;
allocation and heap profiling information;
CPU profiling information;
runtime execution traces;
process command-line information;
mutex, block, thread and allocation profiling data.

This information is normally restricted to global administrators by Arcane's explicit use of WithAdminRequired().

Some profiling operations may also impose additional CPU, memory, or tracing overhead while being collected.

Importantly, this report does not assume that Go's pprof heap endpoint is an arbitrary raw-process-memory dump. Direct extraction of session tokens, environment access tokens, passwords, or other credentials from pprof output has not been demonstrated and is therefore not claimed as part of the confirmed impact.

The confirmed security issue is the authorization bypass itself and the resulting unauthorized exposure of administrator-restricted diagnostic functionality.

Root Cause

The root cause is that authentication through an environment access token takes an early-success path:

environmentScopedInternal(c, env)
return next(c)

before common middleware authorization options are evaluated.

As a result, authorization requirements configured on the middleware are dependent on which authentication mechanism is used.

Authentication establishes the identity and scope of the caller, but route-level authorization requirements such as AdminRequired should subsequently be applied consistently regardless of the authentication mechanism.

Remediation

The environment-token authentication path should not call next(c) before the configured authorization requirements have been evaluated.

One approach is to resolve the environment token into its EnvironmentPermissionSet and then pass that permission set through the same authorization-option evaluation used by other authentication mechanisms.

For example, logically:

if envTokenIsValid {
    ps := authz.EnvironmentPermissionSet(env.ID)

    if m.options.AdminRequired && !ps.IsGlobalAdmin() {
        return forbidden
    }

    environmentScopedInternal(c, env)
    return next(c)
}

Because an EnvironmentPermissionSet intentionally has no global permissions, an environment token would then correctly receive HTTP 403 for WithAdminRequired() routes.

As additional defense in depth, the pprof endpoints could explicitly reject environment access tokens and other environment-scoped authentication mechanisms, allowing access only through authentication mechanisms capable of representing a global administrator.

It may also be worth considering whether pprof should be exposed in production by default or enabled only through an explicit diagnostic configuration option.

Regression Tests

The following cases should be covered:

Valid environment access token
+ /api/debug/pprof/heap
=> 403

Normal authenticated non-admin user
+ /api/debug/pprof/hea
=> 403

Unauthenticated request
+ /api/debug/pprof/heap
=> 401/403

Global administrator
+ /api/debug/pprof/heap
=> 200

More generally, tests should verify that every authentication mechanism is subject to middleware options such as AdminRequired.

The issue could also broadly be categorized as an authorization-check bypass caused by inconsistent authorization handling across authentication paths..

No claim of credential extraction, arbitrary process-memory disclosure, or global-administrator takeover is made unless separately demonstrated through dynamic testing.

Severity

4.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/getarcaneapp/arcane/backend/v2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.11.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-96628"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-16T21:12:03Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nArcane v2.10.2 contains an authorization inconsistency in `AuthMiddleware.managerAuth`.\n\nWhen a request supplies a valid environment access token through the `X-Arcane-Agent-Token` header, `managerAuth` resolves the associated environment, installs an environment-scoped permission set, and immediately calls `next(c)`.\n\nThis occurs before the middleware evaluates the `AdminRequired` option and verifies that the caller is a global administrator.\n\nAs a result, an environment-scoped access token can access routes protected with `WithAdminRequired()`, despite the corresponding `EnvironmentPermissionSet` intentionally containing no global or sudo permissions.\n\nIn v2.10.2, the affected admin-only surface is the manager\u0027s Go `pprof` diagnostic interface under:\n\n`/api/debug/pprof/*`\n\nThis exposes diagnostic and runtime profiling information that the application explicitly intends to restrict to global administrators.\n\nThe issue is an incorrect authorization vulnerability (CWE-863).\n\n## Details\n\n### 1. Environment access tokens are accepted by the manager authentication middleware\n\nThe production authentication middleware is configured with an environment access-token resolver:\n\n`backend/internal/di/providers.go`\n\nConceptually, the middleware is constructed as:\n\n```go\nauth.NewAuthMiddleware(authService, cfg).\n    WithApiKeyValidator(apiKey).\n    WithEnvironmentAccessTokenResolver(env).\n    WithPermissionResolver(role)\n```\n\nTherefore, the `X-Arcane-Agent-Token` authentication path is active in the production manager.\n\n### 2. The environment-token path returns before authorization options are evaluated\n\nThe relevant logic is in:\n\n`backend/internal/auth/middleware.go`\n\n`managerAuth` first checks the `X-Arcane-Agent-Token` header.\n\nWhen the token resolves to an environment, the middleware installs an environment-scoped permission set and immediately continues processing:\n\n```go\nif agentToken := req.Header.Get(utils.HeaderAgentToken); agentToken != \"\" {\n    if env, ok := m.resolveEnvironmentAccessToken(ctx, agentToken).Get(); ok {\n        environmentScopedInternal(c, env)\n        return next(c)\n    }\n}\n```\n\nThe important part is the unconditional:\n\n```go\nreturn next(c)\n```\n\nThe normal authentication path later evaluates the middleware\u0027s `AdminRequired` option:\n\n```go\nps := m.resolvePermissionsOrDeny(ctx, user)\n\nif m.options.AdminRequired \u0026\u0026 !ps.IsGlobalAdmin() {\n    return c.JSON(http.StatusForbidden, common.APIError{\n        Code:    \"FORBIDDEN\",\n        Message: \"You don\u0027t have permission to access this resource\",\n    })\n}\n```\n\nThe environment-token branch never reaches this check.\n\nConsequently, `WithAdminRequired()` has no effect when authentication succeeds through a valid environment access token.\n\nThis creates an authorization inconsistency between authentication mechanisms:\n\n- normal user/session authentication \u2192 `AdminRequired` is enforced;\n    \n- environment access-token authentication \u2192 `AdminRequired` is bypassed.\n    \n\n### 3. Environment tokens are intentionally not global-administrator credentials\n\n`backend/pkg/authz/permission_set.go` defines the effective permissions assigned to an environment access token.\n\n`EnvironmentPermissionSet(envID)` grants environment-scoped permissions only for the specified environment:\n\n```go\nfunc EnvironmentPermissionSet(envID string) *PermissionSet {\n    ps := NewPermissionSet()\n\n    if envID == \"\" {\n        return ps\n    }\n\n    for _, p := range AllPermissions() {\n        if IsEnvScoped(p) {\n            ps.AddEnv(envID, p)\n        }\n    }\n\n    return ps\n}\n```\n\nThe implementation explicitly establishes that these credentials do not receive global or sudo permissions.\n\nTherefore, an environment access token should not satisfy a global-administrator authorization requirement.\n\nThe early return in `managerAuth` bypasses this intended privilege boundary.\n\n### 4. `/api/debug/pprof/*` explicitly requires global-administrator authorization\n\nThe diagnostic routes are registered in:\n\n`backend/api/ws/diagnostics.go`\n\nThe `pprof` group is protected using:\n\n```go\npprofGroup := group.Group(\n    \"/debug/pprof\",\n    authMiddleware.WithAdminRequired().Add(),\n)\n```\n\nThe source also documents the intended authorization requirement by noting that pprof keeps the stricter admin-required gate.\n\nThe group exposes handlers including:\n\n```text\n/api/debug/pprof/\n/api/debug/pprof/cmdline\n/api/debug/pprof/profile\n/api/debug/pprof/symbol\n/api/debug/pprof/trace\n/api/debug/pprof/heap\n/api/debug/pprof/goroutine\n/api/debug/pprof/allocs\n/api/debug/pprof/block\n/api/debug/pprof/mutex\n/api/debug/pprof/threadcreate\n```\n\nNamed profiles are dispatched through `pprof.Handler`.\n\nBecause `WithAdminRequired()` is bypassed by the environment-token branch, a valid environment access token can reach these handlers even though its permission set is not globally privileged.\n\n### 5. Other middleware does not restore the missing authorization check\n\nThe CSRF middleware recognizes `X-Arcane-Agent-Token` as a header-based credential and does not apply the normal cross-origin CSRF validation to such requests.\n\nAdditionally, the environment proxy middleware passes through requests that do not target an `/environments/{id}/...` path.\n\nTherefore a request to:\n\n```text\n/api/debug/pprof/*\n```\n\ncan proceed to `managerAuth`, enter the environment-token authentication branch, and reach the pprof handler without another global-administrator authorization check being applied.\n\n## Source-to-sink authorization path\n\nThe vulnerable control flow is:\n\n```text\nX-Arcane-Agent-Token\n        |\n        v\nenvironment access token resolver\n        |\n        v\nenvironment resolved successfully\n        |\n        v\nEnvironmentPermissionSet(environmentID)\n        |\n        v\nreturn next(c)\n        |\n        |  AdminRequired check is skipped\n        v\n/api/debug/pprof/*\n        |\n        v\nnet/http/pprof handler\n```\n\nThe security boundary violation occurs at the early `return next(c)`.\n\n## Proof of Concept\n\n### Preconditions\n\nThe test requires:\n\n1. A valid Arcane environment access token.\n    \n2. An Arcane manager running the affected code.\n    \n3. No global-administrator account or credentials.\n    \n\n### Test 1 \u2014 environment access token\n\nSend a request to an admin-protected pprof endpoint using only an environment access token:\n\n```http\nGET /api/debug/pprof/heap?debug=1 HTTP/1.1\nHost: arcane.example.com\nX-Arcane-Agent-Token: \u003cVALID_ENVIRONMENT_ACCESS_TOKEN\u003e\n```\n\nNo administrator session cookie or administrator Bearer token is supplied.\n\n### Vulnerable behavior\n\nOn an affected instance, the request is expected to reach the pprof handler instead of being rejected by `WithAdminRequired()`.\n\nA successful response demonstrates that the environment-token authentication branch bypasses the administrator requirement.\n\nFor example, the response may contain the Go heap profiling output generated by `net/http/pprof`.\n\n### Test 2 \u2014 non-admin user contrast case\n\nSend the same request using a normal authenticated non-global-admin user:\n\n```http\nGET /api/debug/pprof/heap?debug=1 HTTP/1.1\nHost: arcane.example.com\nAuthorization: Bearer \u003cNON_ADMIN_ACCESS_TOKEN\u003e\n```\n\nThe expected result is:\n\n```http\nHTTP/1.1 403 Forbidden\n```\n\nwith an authorization error indicating that the user does not have permission to access the resource.\n\nThis contrast demonstrates the authorization inconsistency:\n\n```text\nenvironment-scoped token\n        -\u003e admin gate skipped\n        -\u003e pprof handler reached\n\nnormal non-admin user\n        -\u003e admin gate evaluated\n        -\u003e HTTP 403\n```\n\n### Expected secure behavior\n\nA valid environment access token should receive:\n\n```http\nHTTP/1.1 403 Forbidden\n```\n\nfor every route protected with `WithAdminRequired()`.\n\nOnly a caller whose effective permission set satisfies `IsGlobalAdmin()` should be allowed to access these routes.\n\n## Impact\n\nAn attacker who obtains a valid environment access token can cross the intended authorization boundary between an individual environment and manager-wide administrative functionality.\n\nIn the currently identified route configuration, this allows unauthorized access to the manager\u0027s Go `pprof` diagnostic endpoints.\n\nDepending on the requested profile, these endpoints can expose internal runtime and diagnostic information such as:\n\n- goroutine stack traces;\n    \n- function and package names;\n    \n- allocation and heap profiling information;\n    \n- CPU profiling information;\n    \n- runtime execution traces;\n    \n- process command-line information;\n    \n- mutex, block, thread and allocation profiling data.\n    \n\nThis information is normally restricted to global administrators by Arcane\u0027s explicit use of `WithAdminRequired()`.\n\nSome profiling operations may also impose additional CPU, memory, or tracing overhead while being collected.\n\nImportantly, this report does **not** assume that Go\u0027s pprof heap endpoint is an arbitrary raw-process-memory dump. Direct extraction of session tokens, environment access tokens, passwords, or other credentials from pprof output has not been demonstrated and is therefore not claimed as part of the confirmed impact.\n\nThe confirmed security issue is the authorization bypass itself and the resulting unauthorized exposure of administrator-restricted diagnostic functionality.\n\n## Root Cause\n\nThe root cause is that authentication through an environment access token takes an early-success path:\n\n```go\nenvironmentScopedInternal(c, env)\nreturn next(c)\n```\n\nbefore common middleware authorization options are evaluated.\n\nAs a result, authorization requirements configured on the middleware are dependent on which authentication mechanism is used.\n\nAuthentication establishes the identity and scope of the caller, but route-level authorization requirements such as `AdminRequired` should subsequently be applied consistently regardless of the authentication mechanism.\n\n## Remediation\n\nThe environment-token authentication path should not call `next(c)` before the configured authorization requirements have been evaluated.\n\nOne approach is to resolve the environment token into its `EnvironmentPermissionSet` and then pass that permission set through the same authorization-option evaluation used by other authentication mechanisms.\n\nFor example, logically:\n\n```go\nif envTokenIsValid {\n    ps := authz.EnvironmentPermissionSet(env.ID)\n\n    if m.options.AdminRequired \u0026\u0026 !ps.IsGlobalAdmin() {\n        return forbidden\n    }\n\n    environmentScopedInternal(c, env)\n    return next(c)\n}\n```\n\nBecause an `EnvironmentPermissionSet` intentionally has no global permissions, an environment token would then correctly receive HTTP 403 for `WithAdminRequired()` routes.\n\nAs additional defense in depth, the pprof endpoints could explicitly reject environment access tokens and other environment-scoped authentication mechanisms, allowing access only through authentication mechanisms capable of representing a global administrator.\n\nIt may also be worth considering whether pprof should be exposed in production by default or enabled only through an explicit diagnostic configuration option.\n\n## Regression Tests\n\nThe following cases should be covered:\n\n```text\nValid environment access token\n+ /api/debug/pprof/heap\n=\u003e 403\n\nNormal authenticated non-admin user\n+ /api/debug/pprof/hea\n=\u003e 403\n\nUnauthenticated request\n+ /api/debug/pprof/heap\n=\u003e 401/403\n\nGlobal administrator\n+ /api/debug/pprof/heap\n=\u003e 200\n```\n\nMore generally, tests should verify that every authentication mechanism is subject to middleware options such as `AdminRequired`.\n\nThe issue could also broadly be categorized as an authorization-check bypass caused by inconsistent authorization handling across authentication paths..\n \n\nNo claim of credential extraction, arbitrary process-memory disclosure, or global-administrator takeover is made unless separately demonstrated through dynamic testing.",
  "id": "GHSA-mp22-58ff-6fhr",
  "modified": "2026-10-16T21:12:04Z",
  "published": "2026-10-16T21:12:03Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/getarcaneapp/arcane/security/advisories/GHSA-mp22-58ff-6fhr"
    },
    {
      "type": "WEB",
      "url": "https://github.com/getarcaneapp/arcane/pull/3881"
    },
    {
      "type": "WEB",
      "url": "https://github.com/getarcaneapp/arcane/commit/4fe4c7ed9483dff7d43e3c4bee6a92037ce886b4"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/getarcaneapp/arcane"
    },
    {
      "type": "WEB",
      "url": "https://github.com/getarcaneapp/arcane/releases/tag/backend/v2.11.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Arcane: Environment access token bypasses the admin-required authorization gate on `/api/debug/pprof`"
}

CVE-2026-96628 (GCVE-0-2026-96628)

Vulnerability from cvelistv5 – Published: 2026-10-16 21:10 – Updated: 2026-10-16 21:10

Title

Arcane: Environment access token bypasses the admin-required authorization gate on `/api/debug/pprof`

Summary

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.11.0, AuthMiddleware.managerAuth accepts X-Arcane-Agent-Token credentials and the environment-token branch calls next before the AdminRequired option is evaluated. An attacker with a valid X-Arcane-Agent-Token can request /api/debug/pprof/* through a route protected by WithAdminRequired because EnvironmentPermissionSet is installed and the request continues without checking IsGlobalAdmin. This exposes administrator-restricted Go pprof runtime and diagnostic information and may impose profiling overhead. This issue is fixed in version 2.11.0.

Severity

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CWE

CWE-863 - Incorrect Authorization

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7771 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/getarcaneapp/arcane/security/a…	x_refsource_CONFIRM
https://github.com/getarcaneapp/arcane/pull/3881	x_refsource_MISC
https://github.com/getarcaneapp/arcane/commit/4fe…	x_refsource_MISC
https://github.com/getarcaneapp/arcane/releases/t…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
getarcaneapp	arcane	Affected: < 2.11.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "arcane",
          "vendor": "getarcaneapp",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.11.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.11.0, AuthMiddleware.managerAuth accepts X-Arcane-Agent-Token credentials and the environment-token branch calls next before the AdminRequired option is evaluated. An attacker with a valid X-Arcane-Agent-Token can request /api/debug/pprof/* through a route protected by WithAdminRequired because EnvironmentPermissionSet is installed and the request continues without checking IsGlobalAdmin. This exposes administrator-restricted Go pprof runtime and diagnostic information and may impose profiling overhead. This issue is fixed in version 2.11.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863: Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-16T21:10:29.214Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/getarcaneapp/arcane/security/advisories/GHSA-mp22-58ff-6fhr",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/getarcaneapp/arcane/security/advisories/GHSA-mp22-58ff-6fhr"
        },
        {
          "name": "https://github.com/getarcaneapp/arcane/pull/3881",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/getarcaneapp/arcane/pull/3881"
        },
        {
          "name": "https://github.com/getarcaneapp/arcane/commit/4fe4c7ed9483dff7d43e3c4bee6a92037ce886b4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/getarcaneapp/arcane/commit/4fe4c7ed9483dff7d43e3c4bee6a92037ce886b4"
        },
        {
          "name": "https://github.com/getarcaneapp/arcane/releases/tag/backend/v2.11.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/getarcaneapp/arcane/releases/tag/backend/v2.11.0"
        }
      ],
      "source": {
        "advisory": "GHSA-mp22-58ff-6fhr",
        "discovery": "UNKNOWN"
      },
      "title": "Arcane: Environment access token bypasses the admin-required authorization gate on `/api/debug/pprof`"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-96628",
    "datePublished": "2026-10-16T21:10:29.214Z",
    "dateReserved": "2026-09-23T14:35:50.129Z",
    "dateUpdated": "2026-10-16T21:10:29.214Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

GHSA-MP22-58FF-6FHR

Summary

Details

1. Environment access tokens are accepted by the manager authentication middleware

2. The environment-token path returns before authorization options are evaluated

3. Environment tokens are intentionally not global-administrator credentials

4. /api/debug/pprof/* explicitly requires global-administrator authorization

5. Other middleware does not restore the missing authorization check

Source-to-sink authorization path

Proof of Concept

Preconditions

Test 1 — environment access token

Vulnerable behavior

Test 2 — non-admin user contrast case

Expected secure behavior

Impact

Root Cause

Remediation

Regression Tests

CVE-2026-96628 (GCVE-0-2026-96628)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour

4. `/api/debug/pprof/*` explicitly requires global-administrator authorization