CVE-2026-96628 getarcaneapp CVE debrief

Who should care

Arcane users and administrators should assess exposure and apply the patch in version 2.11.0 to prevent potential unauthorized access to sensitive diagnostic information. Affected operators, platform administrators, vulnerability management teams, and security teams should review and act on this issue to mitigate potential risks. This includes reviewing system logs for /api/debug/pprof/* routes and ensuring that access controls are in place to protect the

Why it matters

CVE-2026-96628 is a medium-severity issue in Arcane that allows an attacker to access sensitive diagnostic information without proper authentication. Arcane users and administrators should assess exposure and apply the patch in version 2.11.0 to prevent potential unauthorized access.

• Potential exposure of administrator-restricted diagnostic information
• Profiling overhead on affected systems
• Bypass of authentication checks for /api/debug/pprof/* routes
• Possible misuse of X-Arcane-Agent-Token credentials

Technical summary

The AuthMiddleware.managerAuth in Arcane prior to 2.11.0 improperly handles X-Arcane-Agent-Token credentials, allowing an attacker to access /api/debug/pprof/* routes protected by WithAdminRequired without verifying if the user is a global admin. This issue exposes administrator-restricted Go pprof runtime and diagnostic information and may impose profiling overhead on affected systems. The vulnerability is fixed in version 2.11.0, which properly evaluates the AdminRequired option before proceeding with the request.

Defensive priority

Medium priority for Arcane users

Recommended defensive actions

• Review and apply the patch in version 2.11.0
• Restrict access to the X-Arcane-Agent-Token
• Monitor /api/debug/pprof/* routes for suspicious activity
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

Official CVE Program and NVD records detail a medium-severity issue in Arcane, an interface for managing Docker containers. The issue allows an attacker with a valid X-Arcane-Agent-Token to access administrator-restricted Go pprof runtime and diagnostic information without proper authentication.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.