CVE-2026-96626: Arcane: Container-registry credential exfiltration via URL repoint + test to attacker host
Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.5.0, UpdateRegistry and TestRegistry in backend/api/services/containerregistryservice.go allow the registry URL to change while preserving the stored encrypted token. When a holder of registries:update and registries:test repoints a generic registry URL without supplying a replacement token, TestRegistry decrypts the preserved token and RegistryLogin sends it to the attacker-controlled host because normalizeRegistryServerAddressInternal does not restrict the destination. This exposes the stored container-registry PAT or password and can enable image access or tampering. This issue is fixed in version 2.5.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Arcaneto a version that resolves this vulnerability.Fixed in 2.5.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated holder of both registries:update and registries:test permissions can exploit it. The attacker must be able to modify a generic registry entry and invoke its connection test.
What conditions are required for credentials to be exposed?
The targeted registry must have a stored encrypted token, and the attacker must change its URL without providing a replacement token. Testing the modified registry then decrypts the preserved token and sends it during login to the attacker-controlled host.
What is the practical impact of a successful exploit?
The attacker can obtain the stored container-registry personal access token or password. The exposed credential may permit access to container images or allow image tampering, depending on its registry permissions.
How can this be remediated?
Upgrade Arcane to version 2.5.0, which fixes the issue.