Live › vulnerability › CVE-2026-96626
Go to dashboardArcane, a Docker management interface, lets a user with registry update and test permissions repoint a stored registry URL while keeping the saved token. The test then sends that decrypted token to the attacker-chosen host, exposing the registry password or PAT and enabling image access or tampering.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams self-hosting Arcane below version 2.5.0 that have generic container registries configured with saved tokens, and users with registry update and test permissions can trigger the leak. Teams not running Arcane, or running 2.5.0 or later, can skip it.
No product ranges from the sources yet.
2.5.0 are affected.registries:update and registries:test permissions in Arcane.2.5.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.5.0, UpdateRegistry and TestRegistry in backend/api/services/container_registry_service.go allow the registry URL to change while preserving the stored encrypted token. When a holder of registries:update and registries:test repoints a generic registry URL without supplying a replacement token, TestRegistry decrypts the preserved token and RegistryLogin sends it to the attacker-controlled host because normalizeRegistryServerAddressInternal does not restrict the destination. This exposes the stored container-registry PAT or password and can enable image access or tampering. This issue is fixed in version 2.5.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-96626")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.