CVE-2026-120656

OpenKruise kruise-manager exposes an unauthenticated ppof endpoint when enabled, opening it on 0.0.0.0:8090, which can enable a DoS attack triggerable by any RBAC pod...

CVE-2026-120656

The OpenKruise kruise-manager component exposes an unauthenticated ppof endpoint on 0.0.0.0:8090 when the feature is enabled. This configuration flaw allows any RBAC pod to trigger a Denial of Service (DoS) attack. Remediation is associated with the release available in the provided references.

CVE-2026-120656 CVE-2026-120656

OpenKruise kruise-manager exposes an unauthenticated ppof endpoint when enabled, opening it on 0.0.0.0:8090, which can enable a DoS attack triggerable by any RBAC pod...

CVE-2026-86147 Apache bRPC: Arbitrary file creation/truncation via /flags and unbounded profiling duration via /pprof

External control of file name or path and uncontrolled resource consumption in Apache bRPC version 1.18.0 on all platforms allows remote attackers who can reach the builtin service port to create directories and truncate/overwrite files with the privileges of the server process, or to hold the...

CVE-2026-86147

Apache bRPC (version

Apache bRPC resource management error vulnerability

Versions of Apache bRPC prior to 1.18.0 contain a security vulnerability. This vulnerability arises because the built-in /flags service can be manipulated via ?setvalue= to alter the bvar/mbvar dump path; additionally, the bvardumptabs path is not properly sanitized. As a result, remote attackers...

PT-2026-118091

Arcane: Environment access token bypasses the admin-required authorization gate on /api/debug/pprof in github.com/getarcaneapp/arcane/backend...

CVE-2026-96628

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.11.0, AuthMiddleware.managerAuth accepts X-Arcane-Agent-Token credentials and the environment-token branch calls next before the AdminRequired option is evaluated. An attacker with a valid...

GHSA-MP22-58FF-6FHR Arcane: Environment access token bypasses the admin-required authorization gate on `/api/debug/pprof`

Summary Arcane v2.10.2 contains an authorization inconsistency in AuthMiddleware.managerAuth. When a request supplies a valid environment access token through the X-Arcane-Agent-Token header, managerAuth resolves the associated environment, installs an environment-scoped permission set, and...

Arcane: Environment access token bypasses the admin-required authorization gate on `/api/debug/pprof`

Summary Arcane v2.10.2 contains an authorization inconsistency in AuthMiddleware.managerAuth. When a request supplies a valid environment access token through the X-Arcane-Agent-Token header, managerAuth resolves the associated environment, installs an environment-scoped permission set, and...

CVE-2026-96628 Arcane: Environment access token bypasses the admin-required authorization gate on `/api/debug/pprof`

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.11.0, AuthMiddleware.managerAuth accepts X-Arcane-Agent-Token credentials and the environment-token branch calls next before the AdminRequired option is evaluated. An attacker with a valid...

CVE-2026-96628 Arcane: Environment access token bypasses the admin-required authorization gate on `/api/debug/pprof`

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.11.0, AuthMiddleware.managerAuth accepts X-Arcane-Agent-Token credentials and the environment-token branch calls next before the AdminRequired option is evaluated. An attacker with a valid...

CVE-2026-96628 Arcane: Environment access token bypasses the admin-required authorization gate on `/api/debug/pprof`

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.11.0, AuthMiddleware.managerAuth accepts X-Arcane-Agent-Token credentials and the environment-token branch calls next before the AdminRequired option is evaluated. An attacker with a valid...

CVE-2026-96628

Prior to version 2.11.0 , Arcane (a Docker management interface) contains an authorization bypass in AuthMiddleware.managerAuth. When a request uses a valid X-Arcane-Agent-Token, the system resolves the environment and immediately calls next(c), skipping the AdminRequired check. This allows holde...

CVE-2026-96628

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.11.0, AuthMiddleware.managerAuth accepts X-Arcane-Agent-Token credentials and the environment-token branch calls next before the AdminRequired option is evaluated. An attacker with a valid...

EUVD-2026-103176

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.11.0, AuthMiddleware.managerAuth accepts X-Arcane-Agent-Token credentials and the environment-token branch calls next before the AdminRequired option is evaluated. An attacker with a valid...

CVE-2026-96628: Incorrect Authorization

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.11.0, AuthMiddleware.managerAuth accepts X-Arcane-Agent-Token credentials and the environment-token branch calls next before the AdminRequired option is evaluated. An attacker with a valid...

PT-2026-116164

Name of the Vulnerable Software and Affected Versions Arcane versions prior to 2.11.0 Description An authorization inconsistency exists in the AuthMiddleware.managerAuth function. When a request uses a valid environment access token via the X-Arcane-Agent-Token header, the system installs an...

Arcane Authorization Issues Vulnerability

Versions of Arcane prior to 2.11.0 have an authorization issue vulnerability. This vulnerability stems from the AuthMiddleware.managerAuth accepting the X-Arcane-Agent-Token credential, and the environment token branch calls next before evaluating the AdminRequired option. As a result, attackers...

CVE-2026-110619

frp 0.41.0 through 0.71.1 contains a missing authentication vulnerability that allows unauthenticated remote attackers to access pprof debug endpoints because handlers are registered on the root mux outside Basic Authentication. Attackers can query /debug/pprof/ endpoints on frps dashboard or frp...