CVE-2026-96628

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.11.0, AuthMiddleware.managerAuth accepts X-Arcane-Agent-Token credentials and the environment-token branch calls next before the AdminRequired option is evaluated. An attacker with a valid X-Arcane-Agent-Token can request /api/debug/pprof/* through a route protected by WithAdminRequired because EnvironmentPermissionSet is installed and the request continues without checking IsGlobalAdmin. This exposes administrator-restricted Go pprof runtime and diagnostic information and may impose profiling overhead. This issue is fixed in version 2.11.0.

• CWE-863

• https://github.com/getarcaneapp/arcane/commit/4fe4c7ed9483dff7d43e3c4bee6a92037ce886b4
• https://github.com/getarcaneapp/arcane/pull/3881
• https://github.com/getarcaneapp/arcane/releases/tag/backend/v2.11.0
• https://github.com/getarcaneapp/arcane/security/advisories/GHSA-mp22-58ff-6fhr

Published

Oct 16, 2026

Last Modified

Oct 16, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-96615Description NGINX Gateway Fabric has a vulnerability when it…6.5
• CVE-2026-96618Improper Handling of Highly Compressed Data (Data Amplificat…2.1
• CVE-2026-9662The Recover Exit For WooCommerce plugin for WordPress is vul…8.1
• CVE-2026-96620Claude Agent SDK is a Python SDK for Claude Code. Prior to 0…9.2
• CVE-2026-96626Arcane is an interface for managing Docker containers, image…8.5
• CVE-2026-96627Arcane is an interface for managing Docker containers, image…8.8
• CVE-2026-96647The Listdom: AI-powered Business Directory with Classifieds …6.4
• CVE-2026-96648The Data Tables Generator by Supsystic plugin for WordPress …6.4
• CVE-2026-96649The Frontend Post Submission Manager Lite – Frontend Posting…7.2
• CVE-2026-96650The Strong Testimonials plugin for WordPress is vulnerable t…7.2
• CVE-2026-96651Plex Media Server before 1.43.3.10861 builds a file path fro…6.5
• CVE-2026-96652Plex Media Server before 1.43.3.10861 allows SSRF via '/play…4.3