CVE-2026-96628

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.11.0, AuthMiddleware.managerAuth accepts X-Arcane-Agent-Token credentials and the environment-token branch calls next before the AdminRequired option is evaluated. An attacker with a valid X-Arcane-Agent-Token can request /api/debug/pprof/* through a route protected by WithAdminRequired because EnvironmentPermissionSet is installed and the request continues without checking IsGlobalAdmin. This exposes administrator-restricted Go pprof runtime and diagnostic information and may impose profiling overhead. This issue is fixed in version 2.11.0.

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.11.0, AuthMiddleware.managerAuth accepts X-Arcane-Agent-Token credentials and the environment-token branch calls next before the AdminRequired option is evaluated. An attacker with a valid X-Arcane-Agent-Token can request /api/debug/pprof/* through a route protected by WithAdminRequired because EnvironmentPermissionSet is installed and the request continues without checking IsGlobalAdmin. This exposes administrator-restricted Go pprof runtime and diagnostic information and may impose profiling overhead. This issue is fixed in version 2.11.0.

Summary

Arcane v2.10.2 contains an authorization inconsistency in AuthMiddleware.managerAuth.

When a request supplies a valid environment access token through the X-Arcane-Agent-Token header, managerAuth resolves the associated environment, installs an environment-scoped permission set, and immediately calls next(c).

This occurs before the middleware evaluates the AdminRequired option and verifies that the caller is a global administrator.

As a result, an environment-scoped access token can access routes protected with WithAdminRequired(), despite the corresponding EnvironmentPermissionSet intentionally containing no global or sudo permissions.

In v2.10.2, the affected admin-only surface is the manager's Go pprof diagnostic interface under:

/api/debug/pprof/*

This exposes diagnostic and runtime profiling information that the application explicitly intends to restrict to global administrators.

The issue is an incorrect authorization vulnerability (CWE-863).

Details

1. Environment access tokens are accepted by the manager authentication middleware

The production authentication middleware is configured with an environment access-token resolver:

backend/internal/di/providers.go

Conceptually, the middleware is constructed as:

auth.NewAuthMiddleware(authService, cfg).
    WithApiKeyValidator(apiKey).
    WithEnvironmentAccessTokenResolver(env).
    WithPermissionResolver(role)

Therefore, the X-Arcane-Agent-Token authentication path is active in the production manager.

2. The environment-token path returns before authorization options are evaluated

The relevant logic is in:

backend/internal/auth/middleware.go

managerAuth first checks the X-Arcane-Agent-Token header.

When the token resolves to an environment, the middleware installs an environment-scoped permission set and immediately continues processing:

if agentToken := req.Header.Get(utils.HeaderAgentToken); agentToken != "" {
    if env, ok := m.resolveEnvironmentAccessToken(ctx, agentToken).Get(); ok {
        environmentScopedInternal(c, env)
        return next(c)
    }
}

The important part is the unconditional:

return next(c)

The normal authentication path later evaluates the middleware's AdminRequired option:

ps := m.resolvePermissionsOrDeny(ctx, user)

if m.options.AdminRequired && !ps.IsGlobalAdmin() {
    return c.JSON(http.StatusForbidden, common.APIError{
        Code:    "FORBIDDEN",
        Message: "You don't have permission to access this resource",
    })
}

The environment-token branch never reaches this check.

Consequently, WithAdminRequired() has no effect when authentication succeeds through a valid environment access token.

This creates an authorization inconsistency between authentication mechanisms:

• normal user/session authentication → AdminRequired is enforced;

• environment access-token authentication → AdminRequired is bypassed.

3. Environment tokens are intentionally not global-administrator credentials

backend/pkg/authz/permission_set.go defines the effective permissions assigned to an environment access token.

EnvironmentPermissionSet(envID) grants environment-scoped permissions only for the specified environment:

func EnvironmentPermissionSet(envID string) *PermissionSet {
    ps := NewPermissionSet()

    if envID == "" {
        return ps
    }

    for _, p := range AllPermissions() {
        if IsEnvScoped(p) {
            ps.AddEnv(envID, p)
        }
    }

    return ps
}

The implementation explicitly establishes that these credentials do not receive global or sudo permissions.

Therefore, an environment access token should not satisfy a global-administrator authorization requirement.

The early return in managerAuth bypasses this intended privilege boundary.

4. /api/debug/pprof/* explicitly requires global-administrator authorization

The diagnostic routes are registered in: …

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.11.0, AuthMiddleware.managerAuth accepts X-Arcane-Agent-Token credentials and the environment-token branch calls next before the AdminRequired option is evaluated. An attacker with a valid X-Arcane-Agent-Token can request /api/debug/pprof/* through a route protected by WithAdminRequired because EnvironmentPermissionSet is installed and the request continues without checking IsGlobalAdmin. This exposes administrator-restricted Go pprof runtime and diagnostic information and may impose profiling overhead. This issue is fixed in version 2.11.0.

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.11.0, AuthMiddleware.managerAuth accepts X-Arcane-Agent-Token credentials and the environment-token branch calls next before the AdminRequired option is evaluated. An attacker with a valid X-Arcane-Agent-Token can request /api/debug/pprof/* through a route protected by WithAdminRequired because EnvironmentPermissionSet is installed and the request continues without checking IsGlobalAdmin. This exposes administrator-restricted Go pprof runtime and diagnostic information and may impose profiling overhead. This issue is fixed in version 2.11.0.

Summary

Arcane v2.10.2 contains an authorization inconsistency in AuthMiddleware.managerAuth.

When a request supplies a valid environment access token through the X-Arcane-Agent-Token header, managerAuth resolves the associated environment, installs an environment-scoped permission set, and immediately calls next(c).

This occurs before the middleware evaluates the AdminRequired option and verifies that the caller is a global administrator.

As a result, an environment-scoped access token can access routes protected with WithAdminRequired(), despite the corresponding EnvironmentPermissionSet intentionally containing no global or sudo permissions.

In v2.10.2, the affected admin-only surface is the manager's Go pprof diagnostic interface under:

/api/debug/pprof/*

This exposes diagnostic and runtime profiling information that the application explicitly intends to restrict to global administrators.

The issue is an incorrect authorization vulnerability (CWE-863).

Details

1. Environment access tokens are accepted by the manager authentication middleware

The production authentication middleware is configured with an environment access-token resolver:

backend/internal/di/providers.go

Conceptually, the middleware is constructed as:

auth.NewAuthMiddleware(authService, cfg).
    WithApiKeyValidator(apiKey).
    WithEnvironmentAccessTokenResolver(env).
    WithPermissionResolver(role)

Therefore, the X-Arcane-Agent-Token authentication path is active in the production manager.

2. The environment-token path returns before authorization options are evaluated

The relevant logic is in:

backend/internal/auth/middleware.go

managerAuth first checks the X-Arcane-Agent-Token header.

When the token resolves to an environment, the middleware installs an environment-scoped permission set and immediately continues processing:

if agentToken := req.Header.Get(utils.HeaderAgentToken); agentToken != "" {
    if env, ok := m.resolveEnvironmentAccessToken(ctx, agentToken).Get(); ok {
        environmentScopedInternal(c, env)
        return next(c)
    }
}

The important part is the unconditional:

return next(c)

The normal authentication path later evaluates the middleware's AdminRequired option:

ps := m.resolvePermissionsOrDeny(ctx, user)

if m.options.AdminRequired && !ps.IsGlobalAdmin() {
    return c.JSON(http.StatusForbidden, common.APIError{
        Code:    "FORBIDDEN",
        Message: "You don't have permission to access this resource",
    })
}

The environment-token branch never reaches this check.

Consequently, WithAdminRequired() has no effect when authentication succeeds through a valid environment access token.

This creates an authorization inconsistency between authentication mechanisms:

• normal user/session authentication → AdminRequired is enforced;

• environment access-token authentication → AdminRequired is bypassed.

3. Environment tokens are intentionally not global-administrator credentials

backend/pkg/authz/permission_set.go defines the effective permissions assigned to an environment access token.

EnvironmentPermissionSet(envID) grants environment-scoped permissions only for the specified environment:

func EnvironmentPermissionSet(envID string) *PermissionSet {
    ps := NewPermissionSet()

    if envID == "" {
        return ps
    }

    for _, p := range AllPermissions() {
        if IsEnvScoped(p) {
            ps.AddEnv(envID, p)
        }
    }

    return ps
}

The implementation explicitly establishes that these credentials do not receive global or sudo permissions.

Therefore, an environment access token should not satisfy a global-administrator authorization requirement.

The early return in managerAuth bypasses this intended privilege boundary.

4. /api/debug/pprof/* explicitly requires global-administrator authorization

The diagnostic routes are registered in: …

Arcane: Environment access token bypasses the admin-required authorization gate on /api/debug/pprof in github.com/getarcaneapp/arcane/backend