ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2026-96628

Arcane: Environment access token bypasses the admin-required authorization gate on

Published Oct 16, 2026 · catalog updated Oct 16, 2026 · Arcane: Environment access token

Check if you run it

No confirmed exploitation is on record for CVE-2026-96628. EPSS is 0.20%. Act only if a listed version of Arcane: Environment access token is installed.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (Arcane: Environment access token).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
Medium4.3
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.20%
Remediation
Version ranges on file
Affected products
Go github.com/getarcaneapp/arcane/backend/v2 · go github.com/getarcaneapp/arcane/backend/v2 · golang github.com

## Summary Arcane v2.10.2 contains an authorization inconsistency in . When a request supplies a valid environment access token through the header, resolves the associated environment, installs an environment-scoped permission set, and immediately calls . This occurs before the middleware evaluates the option and verifies that the caller is a global administrator. As a result, an environment-scoped access token can access routes protected with , despite the corresponding intentionally containing no global or sudo permissions. In v2.10.2, the affected admin-only surface is the manager's Go diagnostic interface under: This exposes diagnostic and runtime profiling information that the application explicitly intends to restrict to global administrators. The issue is an incorrect authorization vulnerability (CWE-863). ## Details ### 1. Environment access tokens are accepted by the manager authentication middleware The production authentication middleware is configured with an environment access-token resolver: Conceptually, the middleware is constructed as: Therefore, the authentication path is active in the production manager. ### 2. The environment-token path returns before authorization options are evaluated The relevant logic is in: first checks the header. When the token resolves to an environment, the middleware installs an environment-scoped permission set and immediately continues processing: The important part is the unconditional: The normal authentication path later evaluates the middleware's option: The environment-token branch never reaches this check. Consequently, has no effect when authentication succeeds through a valid environment access token. This creates an authorization inconsistency between authentication mechanisms: - normal user/session authentication → is enforced; - environment access-token authentication → is bypassed. ### 3. Environment tokens are intentionally not global-administrator credentials defines the effective permissions assigned to

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • Go github.com/getarcaneapp/arcane/backend/v20 → 2.11.0
  • go github.com/getarcaneapp/arcane/backend/v2< 2.11.0
  • go github.com/getarcaneapp/arcane/backend/v2<2.11.0
  • golang github.comversion unspecified

How to fix CVE-2026-96628

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-96628. EPSS is 0.20%. Act only if a listed version of Arcane: Environment access token is installed.

Which versions are affected?

Compare what you have installed with 0 → 2.11.0, < 2.11.0, <2.11.0. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-863: Incorrect Authorization. EPSS 0.20%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 16, 2026 · GitHub Advisory Database

    Detected

    ## Summary Arcane v2.10.2 contains an authorization inconsistency in . When a request supplies a valid environment access token through the header, resolves the associated environment, installs an environment-scoped permission set, and immediately calls . This occurs before the middleware evaluates the option and verifies that the caller is a global administrator. As a result, an environment-scope

  2. Oct 16, 2026 · GitHub Advisory Database

    Fix available

    github.com/getarcaneapp/arcane/backend/v2 fixed in 2.11.0

  3. Oct 16, 2026 · GitHub Advisory Database

    Fix available

    github.com/getarcaneapp/arcane/backend/v2 fixed in 2.11.0

  4. Oct 16, 2026 · GitHub Advisory Database

    Updated

    ## Summary Arcane v2.10.2 contains an authorization inconsistency in . When a request supplies a valid environment access token through the header, resolves the associated environment, installs an environment-scoped permission set, and immediately calls . This occurs before the middleware evaluates the option and verifies that the caller is a global administrator. As a result, an environment-scope

Sources

  • CVE.orgVulnerability recordCVE-2026-96628

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-96628

    30-day exploitation probability 0.2%

    first.org
  • GitHub Advisory DatabasePackage advisoryGHSA-mp22-58ff-6fhr

    GitHub Advisory Database record mirrored by OSV.

    github.com
  • GitLab Advisory DatabasePackage advisoryCVE-2026-96628

    Arcane v2.10.2 contains an authorization inconsistency in AuthMiddleware.managerAuth. When a request supplies a valid environment access token through the X-Arcane-Agent-Token header, managerAuth resolves the associated environment, installs an environment-scoped permission set, and immediately calls next(c). This occurs before the middleware evaluates the AdminRequired option and verifies that th

    advisories.gitlab.com
  • GitLab Advisory DatabasePackage advisorygo/github.com/getarcaneapp/arcane/backend/v2/CVE-2026-96628.yml

    Arcane v2.10.2 contains an authorization inconsistency in .\n\nWhen + a request supplies a valid environment access token through the + header, resolves the associated environment, installs an environment-scoped + permission set, and immediately calls .\n\nThis occurs before the middleware + evaluates the option and verifies that the caller is a global administrator.\n\nAs + a result, an environme

    gitlab.com
  • Go Vulnerability DatabasePackage advisoryGHSA-mp22-58ff-6fhr

    Arcane: Environment access token bypasses the admin-required authorization gate on

    osv.dev
  • OpenSSF OSV / OSV ScannerPackage advisoryGHSA-mp22-58ff-6fhr

    Arcane: Environment access token bypasses the admin-required authorization gate on

    osv.dev

References

Freshness

Last verified in this catalog Oct 18, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.