Go/github.com/getarcaneapp/arcane/backend/v2 CVE-2026-96628: medium 4.3

Arcane: Environment access token bypasses the admin-required authorization gate on `/api/debug/pprof`

Action: Upgrade github.com/getarcaneapp/arcane/backend/v2 to 2.11.0 or later.

go get github.com/getarcaneapp/arcane/backend/v2@v2.11.0

Affected

Fixed versions

Sources

• osv: GHSA-mp22-58ff-6fhr
• https://github.com/getarcaneapp/arcane/security/advisories/GHSA-mp22-58ff-6fhr
• https://github.com/getarcaneapp/arcane/pull/3881
• https://github.com/getarcaneapp/arcane/commit/4fe4c7ed9483dff7d43e3c4bee6a92037ce886b4
• https://github.com/getarcaneapp/arcane
• https://github.com/getarcaneapp/arcane/releases/tag/backend/v2.11.0

CVE-2026-96628 · published 2026-10-16T21:12:03Z · modified 2026-10-19T21:40:57.005773177Z · JSON