CVE-2026-96626
8.5HighPublished 16 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- High impact on confidentiality
- Weakness
- CWE-200, CWE-522
Impact
Authenticated users with registry update and test permissions can steal stored container registry passwords or access tokens. They do this by repointing an existing registry URL to an attacker-controlled server and triggering a test login.
Root cause
The registry service retains the original encrypted token when the registry URL is updated, and the test routine sends that decrypted credential to the new arbitrary destination without validation.
Affected systems
Arcane versions prior to 2.5.0
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
Fix & remediation
Upgrade Arcane to version 2.5.0 or later. If patching immediately is not possible, revoke registries:update and registries:test permissions from untrusted users.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.5.0, UpdateRegistry and TestRegistry in backend/api/services/container_registry_service.go allow the registry URL to change while preserving the stored encrypted token. When a holder of registries:update and registries:test repoints a generic registry URL without supplying a replacement token, TestRegistry decrypts the preserved token and RegistryLogin sends it to the attacker-controlled host because normalizeRegistryServerAddressInternal does not restrict the destination. This exposes the stored container-registry PAT or password and can enable image access or tampering. This issue is fixed in version 2.5.0.