CVE-2026-96628 in Arcane
Summary
by MITRE • 10/17/2026
Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.11.0, AuthMiddleware.managerAuth accepts X-Arcane-Agent-Token credentials and the environment-token branch calls next before the AdminRequired option is evaluated. An attacker with a valid X-Arcane-Agent-Token can request /api/debug/pprof/* through a route protected by WithAdminRequired because EnvironmentPermissionSet is installed and the request continues without checking IsGlobalAdmin. This exposes administrator-restricted Go pprof runtime and diagnostic information and may impose profiling overhead. This issue is fixed in version 2.11.0.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/17/2026
The vulnerability identified in Arcane, a management interface for Docker containers, images, networks, and volumes, represents a critical authentication bypass within the application's middleware chain prior to version 2.11.0. The core of this flaw lies in the execution order of security checks within the AuthMiddleware.managerAuth function. Specifically, when processing requests authenticated via an X-Arcane-Agent-Token credential under the environment-token branch logic, the system invokes the next handler in the request pipeline before evaluating the AdminRequired option. This sequencing error creates a window where administrative privileges are not properly validated against the requesting user's actual role or global admin status.
From a technical perspective, this implementation defect allows an attacker possessing a valid X-Arcane-Agent-Token to access endpoints that should be restricted to administrators only. The most significant consequence of this bypass is the ability to request paths under /api/debug/pprof/*. These routes are protected by middleware intended to enforce administrative requirements via WithAdminRequired and EnvironmentPermissionSet. However, due to the premature invocation of next(), the IsGlobalAdmin check is effectively skipped for these specific requests. This results in an unauthorized exposure of Go pprof runtime data and diagnostic information that requires elevated privileges to access securely.
The operational impact of this vulnerability extends beyond simple information disclosure. The exposed Go pprof endpoints provide detailed insights into the application's performance, memory usage, goroutine states, and execution profiles. An attacker can leverage this data for further reconnaissance or profiling overhead attacks, potentially degrading service availability by forcing resource-intensive operations on the server side. This aligns with CWE-284, which describes Improper Access Control issues where authorization checks are bypassed, allowing users to access resources they should not be permitted to view. Furthermore, in the context of the MITRE ATT&CK framework, this vulnerability facilitates Initial Access and Discovery tactics by enabling an authenticated but non-administrative user to gather critical system intelligence that could aid in subsequent exploitation steps or lateral movement within a containerized environment.
To mitigate this risk, organizations running Arcane must upgrade immediately to version 2.11.0 or later, where the middleware ordering has been corrected to ensure administrative checks are performed before handler execution. For environments unable to patch instantly, implementing strict network-level access controls such as firewall rules or reverse proxy configurations that restrict access to /api/debug/pprof/* endpoints exclusively from trusted internal management networks can provide a temporary layer of defense. Additionally, auditing the middleware chain for similar ordering issues in other parts of the application is recommended to prevent analogous bypasses in different functional areas.