{"id":"EUVD-2026-103176","enisaUuid":"09c40a1f-12e2-3b4a-b8ae-ee39e6eb7dd6","description":"Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.11.0, AuthMiddleware.managerAuth accepts X-Arcane-Agent-Token credentials and the environment-token branch calls next before the AdminRequired option is evaluated. An attacker with a valid X-Arcane-Agent-Token can request /api/debug/pprof/* through a route protected by WithAdminRequired because EnvironmentPermissionSet is installed and the request continues without checking IsGlobalAdmin. This exposes administrator-restricted Go pprof runtime and diagnostic information and may impose profiling overhead. This issue is fixed in version 2.11.0.","datePublished":"Oct 16, 2026, 9:10:29 PM","dateUpdated":"Oct 19, 2026, 4:40:50 PM","baseScore":4.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","references":"https://github.com/getarcaneapp/arcane/security/advisories/GHSA-mp22-58ff-6fhr\nhttps://github.com/getarcaneapp/arcane/pull/3881\nhttps://github.com/getarcaneapp/arcane/commit/4fe4c7ed9483dff7d43e3c4bee6a92037ce886b4\nhttps://github.com/getarcaneapp/arcane/releases/tag/backend/v2.11.0\n","aliases":"CVE-2026-96628\nGHSA-mp22-58ff-6fhr\n","assigner":"GitHub_M","epss":0.2,"enisaIdProduct":[{"id":"2bdb9721-002c-362c-b75b-e46d8443588e","product":{"name":"Arcane","vendor":{"name":"getarcaneapp"}},"product_version":"\u003c 2.11.0"}],"enisaIdVendor":[{"id":"49e1e125-4740-3893-aaa6-37af222c8b9b","vendor":{"name":"getarcaneapp"}}],"enisaIdVulnerability":[{"id":"3ec30ea3-733d-3c4e-ab8d-e08eb778f244","vulnerability":{"id":"CVE-2026-96628","description":"Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.11.0, AuthMiddleware.managerAuth accepts X-Arcane-Agent-Token credentials and the environment-token branch calls next before the AdminRequired option is evaluated. An attacker with a valid X-Arcane-Agent-Token can request /api/debug/pprof/* through a route protected by WithAdminRequired because EnvironmentPermissionSet is installed and the request continues without checking IsGlobalAdmin. This exposes administrator-restricted Go pprof runtime and diagnostic information and may impose profiling overhead. This issue is fixed in version 2.11.0.","datePublished":"Oct 16, 2026, 9:10:29 PM","dateUpdated":"Oct 19, 2026, 4:40:50 PM","status":"PUBLISHED","baseScore":4.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","references":"https://github.com/getarcaneapp/arcane/security/advisories/GHSA-mp22-58ff-6fhr\nhttps://github.com/getarcaneapp/arcane/pull/3881\nhttps://github.com/getarcaneapp/arcane/commit/4fe4c7ed9483dff7d43e3c4bee6a92037ce886b4\nhttps://github.com/getarcaneapp/arcane/releases/tag/backend/v2.11.0\n","enisa_id":"EUVD-2026-103176\n","assigner":"GitHub_M","epss":0.2,"dataProcessed":"Nov 1, 2026, 7:21:06 AM","vulnerabilityProduct":[{"id":"e4bd4ee4-1d44-3d1c-b3e2-a9af09bf2eab","product":{"name":"Arcane","vendor":{"name":"getarcaneapp"}},"product_version":"\u003c 2.11.0"}],"vulnerabilityVendor":[{"id":"b0f233d5-12b4-36cf-8975-5c19ff60f7fc","vendor":{"name":"getarcaneapp"}}]}},{"id":"f07972cd-b791-310d-8aee-bdbfafa7e469","vulnerability":{"id":"GHSA-mp22-58ff-6fhr","description":"Arcane: Environment access token bypasses the admin-required authorization gate on `/api/debug/pprof`","datePublished":"Oct 16, 2026, 9:12:03 PM","dateUpdated":"Oct 16, 2026, 9:12:04 PM","baseScore":0.0,"references":"https://github.com/getarcaneapp/arcane/security/advisories/GHSA-mp22-58ff-6fhr\nhttps://github.com/getarcaneapp/arcane/pull/3881\nhttps://github.com/getarcaneapp/arcane/commit/4fe4c7ed9483dff7d43e3c4bee6a92037ce886b4\nhttps://github.com/getarcaneapp/arcane\nhttps://github.com/getarcaneapp/arcane/releases/tag/backend/v2.11.0\n","enisa_id":"EUVD-2026-103176\n","aliases":"GHSA-mp22-58ff-6fhr\nCVE-2026-96628\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:08:27 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}