CVE-2026-96628

CVE-2026-96628 · Arcane: Environment access token bypasses the admin-required authorization gate on `/api/debug/pprof`

Здесь приведены факты из открытых источников об уязвимостях. Перед обновлением ознакомьтесь с исходным сообщением.

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.11.0, AuthMiddleware.managerAuth accepts X-Arcane-Agent-Token credentials and the environment-token branch calls next before the AdminRequired option is evaluated. An attacker with a valid X-Arcane-Agent-Token can request /api/debug/pprof/* through a route protected by WithAdminRequired because EnvironmentPermissionSet is installed and the request continues without checking IsGlobalAdmin. This exposes administrator-restricted Go pprof runtime and diagnostic information and may impose profiling overhead. This issue is fixed in version 2.11.0.

CVSS 4.3 · Средний · EPSS 0,2%

Опубликовано

2026-10-16T21:10:29.214Z

Обновлено

2026-10-19T16:40:50.253Z

Проверьте свой сервер →