CVE-2026-96626 Details
Description
Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.5.0, UpdateRegistry and TestRegistry in backend/api/services/container_registry_service.go allow the registry URL to change while preserving the stored encrypted token. When a holder of registries:update and registries:test repoints a generic registry URL without supplying a replacement token, TestRegistry decrypts the preserved token and RegistryLogin sends it to the attacker-controlled host because normalizeRegistryServerAddressInternal does not restrict the destination. This exposes the stored container-registry PAT or password and can enable image access or tampering. This issue is fixed in version 2.5.0.
A vulnerability in Arcane's container registry management feature, present in versions through 2.4.0, allows for the unauthorized exfiltration of stored credentials (Personal Access Tokens or passwords) to an attacker-controlled host. This issue arises because the 'UpdateRegistry' function can change the registry URL without overwriting the existing token, which is then decrypted and sent to the attacker's server when 'TestRegistry' is called. The vulnerability exploits a lack of proper validation when changing registry URLs, leaving the door open for credential theft.
Users can update to Arcane version 2.5.0, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 16, 2026CISA-ADP
Assessed Oct 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/getarcaneapp/arcane/commit/fe31693634f48f295a7d77d091085b331cf9e915 | [email protected] | Source CodeVendor |
| https://github.com/getarcaneapp/arcane/pull/3317 | [email protected] | Issue TrackingVendor |
| https://github.com/getarcaneapp/arcane/releases/tag/backend/v2.5.0 | [email protected] | Source CodeVendor |
| https://github.com/getarcaneapp/arcane/security/advisories/GHSA-9pxc-cxp5-qp54 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
| CWE-522 | Insufficiently Protected Credentials | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Arcane | <= 2.4.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 28, 2026 | CVE Modified | CISA-ADP |
| Oct 16, 2026 | New CVE Received | [email protected] |