CVE-2026-96626: Arcane Docker Registry Credential Exposure via URL Swap

Overview

Arcane, an open-source web interface for managing Docker containers, images, networks, and volumes, carries a high-severity credential exposure flaw tracked as CVE-2026-96626 (CVSS 8.5). A user holding only the registries:update and registries:test permissions — not full administrative access — can abuse the registry test/login flow to force Arcane to decrypt a stored registry token and send it to a server the attacker controls.

The issue lives in backend/api/services/container_registry_service.go, in the UpdateRegistry and TestRegistry functions, and is fixed in Arcane 2.5.0.

Technical Details

How It Works

Arcane lets administrators register generic container registries, storing an encrypted authentication token (a personal access token or password) against each registry entry so the application can log in on the user's behalf. UpdateRegistry permits changing a registry's URL without requiring a replacement token to be supplied — the existing encrypted token is simply carried over to the new URL.

The exploit path: an attacker who holds registries:update and registries:test (but not full admin rights) repoints an existing generic registry's URL to a server they control, without providing a new token. They then trigger TestRegistry, which decrypts the preserved token and calls RegistryLogin against the configured address. Because normalizeRegistryServerAddressInternal does not validate or restrict the destination host, the decrypted credential is sent straight to the attacker's server in the login request — fully exfiltrating the registry's stored secret.

Impact Assessment

Who Is At Risk

Any Arcane deployment running a version before 2.5.0 that:

• Has one or more generic container registries configured with stored credentials (PAT or password)
• Grants any user or role the registries:update and registries:test permissions without also trusting them with full registry administration

Attack Chain

1. Limited access — Attacker holds a low-privilege role scoped to registries:update and registries:test, short of full admin
2. URL swap — Attacker changes a configured registry's URL to point at infrastructure they control, leaving the existing encrypted token in place
3. Trigger decrypt-and-send — Attacker calls TestRegistry, which decrypts the stored token and submits it via RegistryLogin to the attacker-controlled host
4. Credential theft — Attacker now holds the plaintext registry PAT or password, enabling pull/push access to the real registry or further lateral movement if the credential is reused elsewhere

Related Vulnerabilities

Two related Arcane flaws were disclosed alongside this one and are also fixed in 2.5.0:

• CVE-2026-96627 (CVSS 8.8) — privilege escalation via UpdateUser password handling
• CVE-2026-96628 (CVSS 4.3) — incorrect authorization in AuthMiddleware.managerAuth

Mitigation

Immediate Actions

• Upgrade to Arcane 2.5.0 or later, which fixes the registry URL/token handling along with the two related CVEs above
• Rotate credentials for any generic registries configured in Arcane prior to upgrading — treat stored PATs and passwords as potentially exposed
• Review which roles currently hold registries:update and registries:test and tighten scoping until patched

Detection Opportunities

• Audit registry configuration change history for URL modifications that were not accompanied by a token update
• Review outbound network logs from the Arcane host for registry login attempts to unexpected or newly configured hostnames
• Check for registry entries pointing to domains that don't match your organization's actual registry providers

Defence-in-Depth

• Apply least-privilege scoping to registry management permissions rather than bundling registries:update and registries:test with broader container-management roles
• Prefer short-lived or scoped registry tokens over long-lived PATs where the registry provider supports it, to limit the damage of any future exposure

Discovery & Disclosure

CVE-2026-96626 was reserved on September 23, 2026 and publicly disclosed on October 16, 2026 via GitHub Security Advisory GHSA-9pxc-cxp5-qp54, with the fix shipped in commit fe31693 and pull request #3317. As of publication, no public proof-of-concept exploit has been observed, but given the low privilege bar and lack of user interaction required, affected deployments should prioritize patching.

References

• NVD — CVE-2026-96626
• Strix — CVE-2026-96626: Information Disclosure Vulnerability
• GitHub Security Advisory GHSA-9pxc-cxp5-qp54