Arcane EUVD-2026-103176

Requires possession of a valid environment-scoped access token presented via the X-Arcane-Agent-Token header; this is NOT an unauthenticated flaw. The vulnerable code path is the environment-token branch of AuthMiddleware.managerAuth, which must be active - production managers are configured with WithEnvironmentAccessTokenResolver, so the path is enabled by default. Exploitation targets routes guarded by WithAdminRequired(), concretely the Go pprof interface at /api/debug/pprof/*. Limiting factors: the attacker must already hold a legitimate environment access token (so risk is scoped to deployments that distribute such tokens to less-trusted operators/agents), only backend versions prior to 2.11.0 are affected, and the gain is read-only diagnostic/profiling disclosure rather than configuration change or code execution.

This is a genuine but modest-severity authorization flaw, best treated as medium-low priority rather than an urgent fire. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, base 4.3) is internally consistent with the source evidence: exploitation is network-reachable and low-complexity, but requires PR:L - the attacker must already hold a valid environment-scoped X-Arcane-Agent-Token, which is a meaningful barrier. The impact is confined to confidentiality (C:L): leakage of Go pprof runtime/diagnostic data, with no integrity impact and only a minor, un-scored availability concern (the advisory notes profiling 'overhead'). No EPSS score, no CISA KEV listing, and no public exploit were provided in the intelligence, so there is no signal of active or widespread exploitation - consistent with a low-profile niche product. The strongest confirmation comes from the GHSA advisory, merged PR #3881, and the fixing commit, which precisely corroborate the root cause (the environment-token branch calling next() before the AdminRequired check). The main caveat: this is a privilege-escalation-within-authenticated-context issue (a scoped token reaching an admin-only surface), not an unauthenticated RCE, so raw exposure is limited to deployments that issue environment access tokens to lower-trust parties.

An actor who holds a valid environment-scoped X-Arcane-Agent-Token (for example, a limited multi-environment operator or a compromised agent credential) sends an HTTP request bearing that token to a route protected by WithAdminRequired(), such as /api/debug/pprof/*. Because managerAuth installs the EnvironmentPermissionSet and calls next() before evaluating AdminRequired, the request is served despite the token lacking global-admin rights, returning Go pprof runtime and diagnostic data intended only for global administrators. No public exploit code was identified, but the fix diff and advisory fully describe the trigger.