Is CVE-2026-96628 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-96628 being exploited in the wild.

How severe is CVE-2026-96628?

Medium severity, with a CVSS score of 4.3, published 16 October 2026.

Which products and versions are affected?

github.com/getarcaneapp/arcane/backend (Go) SEMVER:introduced=0; github.com/getarcaneapp/arcane/backend/v2 (Go) < 2.11.0, SEMVER:introduced=0,fixed=2.11.0; Arcane v2.10.2.

How is CVE-2026-96628 attacked?

It is attacked over the network.

Am I affected by CVE-2026-96628?

Check whether you run github.com/getarcaneapp/arcane/backend (Go), github.com/getarcaneapp/arcane/backend/v2 (Go) or Arcane at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-96628: Arcane authorization bypass in pprof diagnostic endpoints

Q: Is there a fix for CVE-2026-96628?

Yes. github.com/getarcaneapp/arcane/backend/v2 (Go): upgrade to 2.11.0 or later. Until then: Restrict network access to the /api/debug/pprof/* endpoints to only trusted administrators until an update is applied. Disable pprof diagnostic endpoints in production if they are not actively needed for troubleshooting. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-96628 attacked?

It is attacked over the network.

Q: Am I affected by CVE-2026-96628?

Check whether you run github.com/getarcaneapp/arcane/backend (Go), github.com/getarcaneapp/arcane/backend/v2 (Go) or Arcane at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-96628 · Severity: medium · CVSS 4.3 · Published 2026-10-16

Arcane is a manager application that controls secure access to environments and manages credentials. An attacker with a valid environment access token can bypass administrator authorization checks and reach diagnostic profiling endpoints that are supposed to be restricted to global administrators only. This allows unauthorized exposure of runtime diagnostic data such as goroutine stack traces, heap profiles, and process information.

Technologies: github.com/getarcaneapp/arcane/backend (Go). Vendors: Go.

Quick answers

Is CVE-2026-96628 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-96628 being exploited in the wild.
How severe is CVE-2026-96628?: Medium severity, with a CVSS score of 4.3, published 16 October 2026.
Which products and versions are affected?: github.com/getarcaneapp/arcane/backend (Go) SEMVER:introduced=0; github.com/getarcaneapp/arcane/backend/v2 (Go) < 2.11.0, SEMVER:introduced=0,fixed=2.11.0; Arcane v2.10.2.
Is there a fix for CVE-2026-96628?: Yes. github.com/getarcaneapp/arcane/backend/v2 (Go): upgrade to 2.11.0 or later. Until then: Restrict network access to the /api/debug/pprof/* endpoints to only trusted administrators until an update is applied. Disable pprof diagnostic endpoints in production if they are not actively needed for troubleshooting. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-96628 attacked?: It is attacked over the network.
Am I affected by CVE-2026-96628?: Check whether you run github.com/getarcaneapp/arcane/backend (Go), github.com/getarcaneapp/arcane/backend/v2 (Go) or Arcane at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/getarcaneapp/arcane/backend/v2 (Go): upgrade to 2.11.0 or later
```
go get github.com/getarcaneapp/arcane/backend/v2@v2.11.0
```

Restrict network access to the /api/debug/pprof/* endpoints to only trusted administrators until an update is applied. Disable pprof diagnostic endpoints in production if they are not actively needed for troubleshooting.

Technical details

An authorization inconsistency in AuthMiddleware.managerAuth causes environment access tokens to bypass the AdminRequired authorization gate before reaching protected routes. When an environment token is presented via the X-Arcane-Agent-Token header, the middleware resolves the associated environment, installs an environment-scoped permission set, and immediately calls next(c) without evaluating the AdminRequired option. The EnvironmentPermissionSet intentionally contains no global or sudo permissions, but the early return bypasses the authorization check that would reject such tokens from accessing admin-only routes like /api/debug/pprof/*.

Affected products

Arcane v2.10.2

Identifiers

CVE-2026-96628
GHSA-mp22-58ff-6fhr
GO-2026-6806

Timeline

2026-10-16: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.