CVE-2026-96628

Executive Summary

CVE-2026-96628 is an authorization bypass in Arcane, a Docker container, image, network, and volume management interface. Prior to version 2.11.0, the AuthMiddleware.managerAuth component accepts X-Arcane-Agent-Token credentials, and the environment-token code path calls next before the AdminRequired option is evaluated. An attacker holding a valid agent token can therefore reach routes protected by WithAdminRequired and access administrator-restricted Go pprof runtime diagnostic endpoints. The impact is confidentiality loss (limited disclosure of runtime internals) and potential denial of service via profiling overhead; the CVSS v3.1 base score is 4.3.

Technical Analysis

Arcane's request middleware (AuthMiddleware.managerAuth) supports multiple credential types, including an environment-token branch that accepts X-Arcane-Agent-Token request headers. In vulnerable versions this branch invokes next — advancing the request to the next handler — before the AdminRequired authorization option is evaluated. Because the EnvironmentPermissionSet is installed when agent-token authentication succeeds, the request proceeds to downstream handlers without the middleware performing its IsGlobalAdmin check.

The authorization decision therefore depends on a control that is never reached on the environment-token path. Routes configured with WithAdminRequired — including the /api/debug/pprof/* endpoints — are consequently reachable by any caller presenting a valid X-Arcane-Agent-Token, even though those routes are intended to be reserved for global administrators. The net effect is a classic CWE-863 (Incorrect Authorization) flaw: authentication succeeds, but the administrative authorization gate is effectively skipped for one credential class.

The exposed surface is the Go pprof runtime and diagnostic subtree under /api/debug/pprof/*. Go's pprof handlers expose CPU, heap, goroutine, block, mutex, and trace profiles along with command-line and symbol metadata about the running process. Disclosure of these artifacts reveals internal memory layout, goroutine state, and execution behavior, which is material reconnaissance for subsequent attacks. Initiating profiles also consumes CPU and memory resources, allowing a low-privileged holder of an agent token to impose profiling overhead on the manager.

The precondition is meaningful: the attacker must possess a valid X-Arcane-Agent-Token. Such tokens are issued to Arcane agents and may be recoverable through agent compromise, leaked configuration, exposed deployment manifests, or lateral movement within the environment. The vulnerability converts an agent-scoped credential into access to an administrator-only diagnostic surface.

Exploitation Scenarios

No public proof-of-concept, Nuclei template, or exploit code is known. The following chain is inferred from the vulnerability class and the technical details in the advisory.

1. Reconnaissance / target identification. The attacker identifies an Arcane manager instance and determines the API base path. They must then obtain a valid agent token — for example from a compromised Arcane agent host, exposed environment variables or configuration files, or artifacts in the deployment pipeline. Because agent tokens are meant for agent-to-manager communication, they are often stored with less protection than administrator credentials.

2. Triggering the flaw. The attacker sends an HTTP request to a route under /api/debug/pprof/* (for example the index, heap, or goroutine profile endpoints) and includes the X-Arcane-Agent-Token header. In AuthMiddleware.managerAuth the environment-token branch calls next before evaluating AdminRequired; EnvironmentPermissionSet is installed and the request continues without an IsGlobalAdmin check. The request therefore reaches the administrator-gated pprof handler.

3. Data retrieval. The response returns Go pprof diagnostic data. The attacker can iterate profile types and request CPU or trace profiles, harvesting goroutine and memory information that describes internal runtime behavior and data structures.

4. Post-exploitation impact. The disclosed diagnostics enable reconnaissance — memory layout, active goroutines, and execution profiling — that can inform follow-on attacks against the manager or its managed Docker environment. Repeated or long-running profile requests can also impose profiling overhead, degrading manager responsiveness. No privilege escalation to administrator actions beyond the pprof surface is described in the advisory; the bypass is scoped to routes that reach handler execution via the flawed middleware path.

Impact Assessment

The CVSS v3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) describes a network-reachable, low-complexity attack requiring low privileges and no user interaction, with limited confidentiality impact and no impact to integrity or availability as scored — although the advisory notes possible profiling overhead. The base score is 4.3 (Medium).

• Confidentiality (C:L): Exposure of Go pprof runtime and diagnostic information to a holder of an agent token. The data is sensitive reconnaissance material but not typically credentials or business records directly.
• Integrity (I:N): No modification of data is described.
• Availability (A:N): Not formally scored; the advisory cautions that profiling requests may impose overhead on the manager process.
• Blast radius: Any Arcane deployment prior to 2.11.0 where agent tokens can be obtained. Because Arcane manages Docker containers, images, networks, and volumes, exposure of its runtime internals is a stepping stone toward the container estate it orchestrates. The attack is not unauthenticated — an agent token is required — which materially limits mass exploitation.

Detection Guidance

Sigma Rule

title: Arcane Agent Token Used to Access Admin-Protected pprof Debug Endpoints
id: 4b7c2f1e-9a3d-4c6e-8f2a-arcaneprof01
status: experimental
description: Detects requests to Arcane /api/debug/pprof/* carrying the X-Arcane-Agent-Token header, indicating exploitation of CVE-2026-96628 authorization bypass.
author: Threat Intelligence
date: 2026-01-01
logsource:
  category: webserver
detection:
  selection_path:
    cs-uri-stem|startswith:
      - '/api/debug/pprof'
  selection_header:
    cs-header|contains: 'X-Arcane-Agent-Token'
  condition: selection_path and selection_header
fields:
  - c-ip
  - cs-method
  - cs-uri-stem
  - cs-user-agent
falsepositives:
  - Authorized administrator diagnostics (should use admin credentials, not agent tokens)
level: high
tags:
  - attack.t1068
  - cve.2026.96628

YARA Rule

rule CVE_2026_96628_Arcane_Agent_Token_pprof
{
    meta:
        description = "Detects HTTP requests exploiting Arcane agent-token auth bypass to reach pprof endpoints (CVE-2026-96628)"
        author = "Threat Intelligence"
        reference = "CVE-2026-96628"
        date = "2026-01-01"
    strings:
        $hdr  = "X-Arcane-Agent-Token" ascii nocase
        $p1   = "/api/debug/pprof" ascii nocase
        $p2   = "pprof/" ascii nocase
        $g1   = "GET " ascii
        $g2   = "POST " ascii
    condition:
        $hdr and ($p1 or $p2) and ($g1 or $g2)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-96628 Arcane Agent Token Access to pprof Debug Endpoint"; flow:established,to_server; http.header; content:"X-Arcane-Agent-Token"; nocase; http.uri; content:"/api/debug/pprof"; nocase; classtype:attempted-recon; reference:cve,2026-96628; sid:2026966280; rev:1;)

Elastic Detection

http where http.request.method in ("GET", "POST")
  and startsWith(http.request.uri.path, "/api/debug/pprof")
  and http.request.headers contains "X-Arcane-Agent-Token"

Splunk SPL Query

index=web (uri_path="/api/debug/pprof" OR uri_path="/api/debug/pprof/*")
| eval agent_hdr=if(match(lower(_raw), "x-arcane-agent-token"), 1, 0)
| where agent_hdr=1
| stats count min(_time) as first_seen max(_time) as last_seen values(uri_path) as paths by src_ip, dest
| where count > 0
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="web,arcane,cve-2026-96628,">
  <rule id="2026966" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <url>/api/debug/pprof</url>
    <regex type="pcre2">X-Arcane-Agent-Token</regex>
    <description>CVE-2026-96628: Arcane agent token used to access admin-protected pprof endpoint</description>
    <mitre>
      <id>T1068</id>
    </mitre>
    <group>attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source claims patch, not independently confirmed).

1. Immediate mitigations.

   • Upgrade Arcane to 2.11.0, where the environment-token branch no longer advances the request before the AdminRequired / IsGlobalAdmin check is evaluated.
   • If upgrade cannot be performed immediately, restrict network access to the Arcane manager API to trusted agent hosts and administrators, and block /api/debug/pprof/* at the reverse proxy or ingress for all clients except designated administrators.
   • Audit and rotate all X-Arcane-Agent-Token credentials; treat any token that may have been exposed as compromised.

2. Patch/upgrade steps.

   • Verify current Arcane version; update to 2.11.0 or later per the GHSA advisory.
   • Re-validate authorization behavior by confirming that agent-token requests to /api/debug/pprof/* are rejected post-upgrade.
   • Review logs for prior requests to /api/debug/pprof/* bearing agent-token headers to determine whether the bypass was exercised.

3. Long-term hardening.

   • Separate credential scopes so that agent tokens can never satisfy administrator-gated routes; enforce authorization as a fail-closed default where the admin check precedes any handler dispatch.
   • Disable or bind pprof/debug endpoints to localhost or a dedicated admin-only listener in production builds.
   • Monitor and alert on access to debug/diagnostic endpoints and on use of agent tokens outside normal agent communication patterns.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-96628
• GitHub Security Advisory (GHSA) for Arcane 2.11.0 fix — referenced by the CNA as the patch source.
• Arcane project repository and release notes for version 2.11.0.
• CWE-863: Incorrect Authorization — https://cwe.mitre.org/data/definitions/863.html

No public exploit code, Nuclei template, or in-the-wild exploitation has been observed. CISA KEV status: not listed. EPSS: not yet scored by FIRST.org.