Arcane environment token bypasses admin authorization

Arcane v2.10.2 contains an authorization flaw where environment-scoped access tokens can bypass admin-required authorization checks on the `/api/debug/pprof` endpoint, exposing diagnostic and runtime profiling information.

Disclosed 16 October 2026 · Record updated 16 October 2026

Impact

Environment-scoped access tokens can access admin-only diagnostic interfaces intended to be restricted to global administrators

Our coverage

A small bronze key slips through a guard's fingers at a checkpoint, unlocking a sealed laboratory door where sensitive instruments lay exposed to unauthorized hands.

Vulnerabilities

Arcane agent token slips past admin check on debug endpoint

An advisory published on 16 October 2026 says environment-scoped tokens in Arcane v2.10.2 can reach Go profiling routes meant for global administrators only.

16 Oct 2026

Sources

github.comhttps://github.com/advisories/GHSA-mp22-58ff-6fhr