Arcane: Container registry credential exfiltration via URL change
Summary
Arcane, a web interface for managing Docker containers, images, networks and volumes, does not stop a stored registry token from being reused after the registry URL is changed. A user with both registries:update and registries:test rights can repoint a generic registry to an attacker-controlled host without supplying a new token, and Arcane then sends the preserved token to that host. A successful attack exposes the registry PAT or password, which can allow image access or tampering in that registry.
Affected
- Arcane versions prior to 2.5.0
- Exploitation requires an account with registries:update and registries:test rights
- Generic registries only (ECR is not affected by the fix path)
Fixed in
- Fixed in Arcane 2.5.0 (backend/v2.5.0), fix commit fe31693634f48f295a7d77d091085b331cf9e915 (PR #3317)
Workaround
- Unknown. No vendor workaround is published.
- Restrict registries:update and registries:test to trusted administrators until the upgrade is done.
Exploitation
- No evidence of active exploitation found.
- No public proof-of-concept known.
- CISA SSVC: exploitation none, automatable no, technical impact partial.
- EPSS 0.00216.
- NVD status: Deferred.
Our recommendation
- Upgrade Arcane to version 2.5.0 or later.
- Review who holds registries:update and registries:test and remove unneeded rights.
- After upgrading, check registry entries for changed URLs. If an untrusted user may have changed one, rotate the stored registry token or password.
- Do not expose the Arcane interface to the internet without a VPN or an authenticated reverse proxy.
- Monitor outbound authentication attempts from Arcane instances.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-9pxc-cxp5-qp54 github.com
- Fix commit fe31693 (container registry service) github.com
- Pull request #3317 github.com
- Arcane release backend/v2.5.0 github.com
- CVE-2026-96626 at Vulners (CNA data) vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 10:27.
Original description (NVD)
Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.5.0, UpdateRegistry and TestRegistry in backend/api/services/container_registry_service.go allow the registry URL to change while preserving the stored encrypted token. When a holder of registries:update and registries:test repoints a generic registry URL without supplying a replacement token, TestRegistry decrypts the preserved token and RegistryLogin sends it to the attacker-controlled host because normalizeRegistryServerAddressInternal does not restrict the destination. This exposes the stored container-registry PAT or password and can enable image access or tampering. This issue is fixed in version 2.5.0.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.