# CVE-2026-96628: Arcane authorization bypass in pprof diagnostic endpoints

Source: https://junglewise.ai/threats/cve-2026-96628-arcane-environment-access-token-bypasses-the-admin-required  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-16. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-96628 · Severity: medium · CVSS 4.3 · Published 2026-10-16

Arcane is a manager application that controls secure access to environments and manages credentials. An attacker with a valid environment access token can bypass administrator authorization checks and reach diagnostic profiling endpoints that are supposed to be restricted to global administrators only. This allows unauthorized exposure of runtime diagnostic data such as goroutine stack traces, heap profiles, and process information.

Technologies: [github.com/getarcaneapp/arcane/backend (Go)](https://junglewise.ai/threats/technologies/github-com-getarcaneapp-arcane-backend). Vendors: [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-96628 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-96628 being exploited in the wild.

**How severe is CVE-2026-96628?** Medium severity, with a CVSS score of 4.3, published 16 October 2026.

**Which products and versions are affected?** github.com/getarcaneapp/arcane/backend (Go) SEMVER:introduced=0; github.com/getarcaneapp/arcane/backend/v2 (Go) < 2.11.0, SEMVER:introduced=0,fixed=2.11.0; Arcane v2.10.2.

**Is there a fix for CVE-2026-96628?** Yes. github.com/getarcaneapp/arcane/backend/v2 (Go): upgrade to 2.11.0 or later. Until then: Restrict network access to the /api/debug/pprof/* endpoints to only trusted administrators until an update is applied. Disable pprof diagnostic endpoints in production if they are not actively needed for troubleshooting. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-96628 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-96628?** Check whether you run github.com/getarcaneapp/arcane/backend (Go), github.com/getarcaneapp/arcane/backend/v2 (Go) or Arcane at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/getarcaneapp/arcane/backend/v2 (Go): upgrade to 2.11.0 or later

  ```sh
  go get github.com/getarcaneapp/arcane/backend/v2@v2.11.0
  ```


Restrict network access to the /api/debug/pprof/* endpoints to only trusted administrators until an update is applied. Disable pprof diagnostic endpoints in production if they are not actively needed for troubleshooting.

## Technical details

An authorization inconsistency in AuthMiddleware.managerAuth causes environment access tokens to bypass the AdminRequired authorization gate before reaching protected routes. When an environment token is presented via the X-Arcane-Agent-Token header, the middleware resolves the associated environment, installs an environment-scoped permission set, and immediately calls next(c) without evaluating the AdminRequired option. The EnvironmentPermissionSet intentionally contains no global or sudo permissions, but the early return bypasses the authorization check that would reject such tokens from accessing admin-only routes like /api/debug/pprof/*.

## Affected products

- Arcane v2.10.2

## Identifiers

- CVE-2026-96628
- GHSA-mp22-58ff-6fhr
- GO-2026-6806

## Timeline

- 2026-10-16: disclosed

## Related threats

- [Arcane users:update permission allows admin account takeover via password reset](https://junglewise.ai/threats/cve-2026-96627-arcane-delegated-users-update-permission-allows-admin-account)
- [Arcane path traversal in Docker Compose include directives](https://junglewise.ai/threats/cve-2026-47179-arcane-path-traversal-in-docker-compose-include-directives)
- [Arcane missing authorization in global variables endpoint](https://junglewise.ai/threats/cve-2026-47125-arcane-missing-authorization-in-global-variables-endpoint)
- [getarcaneapp Arcane reflected XSS in logo endpoint](https://junglewise.ai/threats/cve-2026-45627-getarcaneapp-arcane-reflected-xss-in-logo-endpoint)
- [Arcane OS command injection in volume browser](https://junglewise.ai/threats/cve-2026-45626-arcane-os-command-injection-in-volume-browser)