CVE-2026-96628

MediumCVSS 4.3/10Last modified Oct 19, 2026

Description

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.11.0, AuthMiddleware.managerAuth accepts X-Arcane-Agent-Token credentials and the environment-token branch calls next before the AdminRequired option is evaluated. An attacker with a valid X-Arcane-Agent-Token can request /api/debug/pprof/* through a route protected by WithAdminRequired because EnvironmentPermissionSet is installed and the request continues without checking IsGlobalAdmin. This exposes administrator-restricted Go pprof runtime and diagnostic information and may impose profiling overhead. This issue is fixed in version 2.11.0.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-863

Affected software

No affected versions have been published.

Timeline

Published
Oct 16, 2026
Last modified
Oct 19, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-966366.5Pillow is a Python imaging library. Prior to 13.0.0, MpoImageFile.seek() and DcxImageFile.seek() reparse later MPO or DCX frames and replaceCVE-2026-966377.1Pillow is a Python imaging library. Prior to 13.0.0, SpiderImageFile.seek() in src/PIL/SpiderImagePlugin.py reparses a later SPIDER stack frCVE-2026-966386.5Pillow is a Python imaging library. From 9.1.0 until 13.0.0, BmpRleDecoder.decode() in src/PIL/BmpImagePlugin.py permits crafted RLE BMP delCVE-2026-966399.8Pillow is a Python imaging library. From 11.0.0 until 13.0.0, multi-frame loaders can retain an ImagingCore allocation created for a narrow CVE-2026-966408.2Pillow is a Python imaging library. From 5.1.0 until 13.0.0, PdfParser.linearize_page_tree() in src/PIL/PdfParser.py treats a PDF /Pages graCVE-2026-966416.5Pillow is a Python imaging library. Prior to 13.0.0, PILfont text-width accumulation in src/_imaging.c checks positive glyph advances againsCVE-2026-966427.1Pillow is a Python imaging library. Prior to 13.0.0, the TarIO initializer in src/PIL/TarIO.py accepts a negative octal member size and compCVE-2026-966437.1Pillow is a Python imaging library. From 11.0.0 until 13.0.0, Exif.load() in src/PIL/Image.py repeatedly slices the remaining EXIF data whilCVE-2026-966447.1Pillow is a Python imaging library. Prior to 13.0.0 on Windows, src/PIL/WmfImagePlugin.py passes unchecked 32-bit WMF or EMF dimensions to tCVE-2026-966476.4The Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting vCVE-2026-966486.4The Data Tables Generator by Supsystic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Table Cell 'data' Value via updCVE-2026-966497.2The Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin plugin for WordPress is vulnerable to Stored DOM-Based Cross-S
CVE-2026-96628: Medium severity, CVSS 4.3 | Vulnix