Authorization Bypass in Arcane Interface by GetArcaneApp
CVE-2026-96628

4.3MEDIUM

Key Information:

Vendor: Getarcaneapp
Status: Arcane
Vendor: CVE Published:; 16 October 2026

🔔 Create Getarcaneapp Vulnerability Alert

What is CVE-2026-96628?

The Arcane interface for managing Docker containers has a vulnerability in versions before 2.11.0, where the AuthMiddleware.managerAuth incorrectly processes the X-Arcane-Agent-Token. This flaw allows an attacker with valid credentials to bypass the AdminRequired checks, granting unauthorized access to /api/debug/pprof/* routes that are meant to be restricted. The oversight in the flow allows for the exposure of sensitive Go pprof runtime and diagnostic details, posing a potential risk to application integrity and performance. The issue has been addressed in version 2.11.0.