CVE-2026-96628

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.11.0, AuthMiddleware.managerAuth accepts X-Arcane-Agent-Token credentials and the environment-token branch calls next before the AdminRequired option is evaluated. An attacker with a valid...

Arcane: Environment access token bypasses the admin-required authorization gate on `/api/debug/pprof`

Summary Arcane v2.10.2 contains an authorization inconsistency in AuthMiddleware.managerAuth. When a request supplies a valid environment access token through the X-Arcane-Agent-Token header, managerAuth resolves the associated environment, installs an environment-scoped permission set, and...

GHSA-MP22-58FF-6FHR Arcane: Environment access token bypasses the admin-required authorization gate on `/api/debug/pprof`

Summary Arcane v2.10.2 contains an authorization inconsistency in AuthMiddleware.managerAuth. When a request supplies a valid environment access token through the X-Arcane-Agent-Token header, managerAuth resolves the associated environment, installs an environment-scoped permission set, and...

CVE-2026-96628 Arcane: Environment access token bypasses the admin-required authorization gate on `/api/debug/pprof`

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.11.0, AuthMiddleware.managerAuth accepts X-Arcane-Agent-Token credentials and the environment-token branch calls next before the AdminRequired option is evaluated. An attacker with a valid...

CVE-2026-96628 Arcane: Environment access token bypasses the admin-required authorization gate on `/api/debug/pprof`

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.11.0, AuthMiddleware.managerAuth accepts X-Arcane-Agent-Token credentials and the environment-token branch calls next before the AdminRequired option is evaluated. An attacker with a valid...

CVE-2026-96628 Arcane: Environment access token bypasses the admin-required authorization gate on `/api/debug/pprof`

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.11.0, AuthMiddleware.managerAuth accepts X-Arcane-Agent-Token credentials and the environment-token branch calls next before the AdminRequired option is evaluated. An attacker with a valid...

EUVD-2026-103176

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.11.0, AuthMiddleware.managerAuth accepts X-Arcane-Agent-Token credentials and the environment-token branch calls next before the AdminRequired option is evaluated. An attacker with a valid...

CVE-2026-96628

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.11.0, AuthMiddleware.managerAuth accepts X-Arcane-Agent-Token credentials and the environment-token branch calls next before the AdminRequired option is evaluated. An attacker with a valid...

CVE-2026-96628

Prior to version 2.11.0 , Arcane (a Docker management interface) contains an authorization bypass in AuthMiddleware.managerAuth. When a request uses a valid X-Arcane-Agent-Token, the system resolves the environment and immediately calls next(c), skipping the AdminRequired check. This allows holde...

CVE-2026-96628: Incorrect Authorization

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.11.0, AuthMiddleware.managerAuth accepts X-Arcane-Agent-Token credentials and the environment-token branch calls next before the AdminRequired option is evaluated. An attacker with a valid...

PT-2026-116164

Name of the Vulnerable Software and Affected Versions Arcane versions prior to 2.11.0 Description An authorization inconsistency exists in the AuthMiddleware.managerAuth function. When a request uses a valid environment access token via the X-Arcane-Agent-Token header, the system installs an...

Arcane Authorization Issues Vulnerability

Versions of Arcane prior to 2.11.0 have an authorization issue vulnerability. This vulnerability stems from the AuthMiddleware.managerAuth accepting the X-Arcane-Agent-Token credential, and the environment token branch calls next before evaluating the AdminRequired option. As a result, attackers...

MAL-2026-10707 Malicious code in @ai-support-agent/cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bbbb67d5fa1c4b90e7da8e409f66e2e4ced88c5baa6eb14aa33d1d698d5baf69 The @ai-support-agent/cli package installs a long-running daemon ai-support-agent start that connects to a vendor API default...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization in the CreateSubAgent process. An attacker can gain unauthorized access to workspace applications by registering sub-agent apps with a sharing level that exceeds the administrator's configured maximum, thereby...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization in the CreateSubAgent process. An attacker can gain unauthorized access to workspace applications by registering sub-agent apps with a sharing level that exceeds the administrator's configured maximum, thereby...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization in the CreateSubAgent process. An attacker can gain unauthorized access to workspace applications by registering sub-agent apps with a sharing level that exceeds the administrator's configured maximum, thereby...

Coder's sub-agent app registration bypasses template port-sharing policy enforcement

Summary The CreateSubAgent RPC did not validate a requested app sharing level against the template's MaxPortSharingLevel before persisting workspace apps, letting a workspace owner exceed the administrator's configured maximum. Note: Exploitation requires the ability to register sub-agent apps in...

CVE-2025-12952

A privilege escalation vulnerability exists in Google Cloud's Dialogflow CX. Dialogflow agent developers with Webhook editor permission are able to configure Webhooks using Dialogflow service agent access token authentication. This allows the attacker to escalate their privileges from agent-level...

CVE-2025-12952 Privilege Escalation in Dialogflow CX via Webhook Admin Role

A privilege escalation vulnerability exists in Google Cloud's Dialogflow CX. Dialogflow agent developers with Webhook editor permission are able to configure Webhooks using Dialogflow service agent access token authentication. This allows the attacker to escalate their privileges from agent-level...

CVE-2025-11248

ZohoCorp ManageEngine Endpoint Central versions prior to 11.4.2528.05 are vulnerable to a sensitive information logging issue. An authenticated user with access to the logs could potentially obtain the sensitive agent token...