Arcane Endpoint Manipulation CVE-2026-96626 Exposes Registry Tokens in Pre-2.5.0 Builds

A high-severity vulnerability in the Arcane container management interface exposes stored registry credentials to remote attackers. The flaw, tracked as CVE-2026-96626, affects all versions prior to 2.5.0 and allows malicious users to extract personal access tokens or passwords.

What happened

The National Vulnerability Database records CVE-2026-96626 as a high-severity issue with a CVSS score of 8.5. It stems from weaknesses classified as CWE-200 and CWE-522 within the Arcane application, which manages Docker containers, images, networks, and volumes. The vulnerability exists in the backend API services, specifically within the UpdateRegistry and TestRegistry functions located in container_registry_service.go.

Why it matters

Prior to version 2.5.0, the application allows a registry URL to change while preserving the stored encrypted authentication token. An attacker holding registries:update and registries:test permissions can repoint a generic registry URL without supplying a replacement token. When TestRegistry decrypts the preserved token, RegistryLogin sends it to the attacker-controlled host because normalizeRegistryServerAddressInternal does not restrict the destination.

This exposure reveals stored container-registry personal access tokens or passwords. Such access can enable unauthorised image access or tampering within the affected environment. The issue is fixed in version 2.5.0, according to the vendor. Environments running older versions remain exposed to this credential theft vector until updated.

Next steps

• Identify all Arcane instances running versions prior to 2.5.0 in your infrastructure.
• Review access logs for users with registries:update and registries:test permissions.
• Plan an immediate upgrade to version 2.5.0 to patch the vulnerability.
• Rotate any container registry credentials that may have been exposed during the vulnerability window.

Detection notes

Security teams should monitor for unusual registry URL modifications by users with limited permissions. Look for decryption events followed by outbound connections to unknown or untrusted hosts. Alert on any instance where a registry endpoint changes without a corresponding new token submission. Check application logs for failed normalisation checks or unexpected destination addresses. Contain by revoking suspicious tokens and restricting network egress from management interfaces. Verify that no unauthorised hosts received credential data during the incident window.

What to do and how to stay safe: Arcane

• Audit current Arcane versions across all production and development environments.
• Restrict registries:update and registries:test permissions to essential personnel only.
• Monitor network traffic for unexpected connections from container management services.
• Prepare a patching schedule to deploy version 2.5.0 as soon as it is available.

Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Production

General security guidance from the Packet Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-96626?

The CVSS score is 8.5, which is rated as high severity.

Which permissions are required to exploit this vulnerability?

An attacker needs registries:update and registries:test permissions to exploit the flaw.

Is there a fix available for this issue?

Yes, the issue is fixed in Arcane version 2.5.0.