Key points
- The vulnerability is assigned CVE-2026-96626 with a CVSS score of 8.5.
- It affects all versions of the Arcane application prior to version 2.5.0.
- The issue is resolved in the vendor release of version 2.5.0.
Users of the Arcane interface for managing Docker containers must update to version 2.5.0 immediately to address a high-severity security flaw. The vulnerability, tracked as CVE-2026-96626, carries a CVSS score of 8.5. It allows attackers to steal stored encrypted tokens from container registries. This exposure can lead to unauthorized image access or tampering within affected systems.
In plain English
Arcane helps teams manage Docker containers, images, networks, and volumes. Before version 2.5.0, the software had a flaw in how it handled registry settings. When a user with specific permissions changed a registry URL, the system kept the old encrypted login token. If the new URL pointed to an attacker-controlled host, the software would send that token to the attacker. This happens because the internal address normalization function does not restrict where the token is sent.
The background
The issue stems from weaknesses classified as CWE-200 and CWE-522. According to the National Vulnerability Database, the flaw exists in the backend API services for container registry management. Specifically, the UpdateRegistry and TestRegistry functions allow the registry URL to change while preserving the stored encrypted token. When a user repoints a generic registry URL without providing a new token, the system decrypts the preserved token. It then sends this sensitive data to the new, potentially malicious host.
What changes now
The vendor has released version 2.5.0 to fix this issue. This update addresses the logic error that allowed tokens to be sent to unrestricted destinations. Users running any version of Arcane prior to 2.5.0 are vulnerable to this credential exposure. The fix ensures that the system does not automatically send stored tokens to new registry addresses without proper validation. Organizations should verify their current version and apply the update to protect their container registry credentials.
Who needs to act first
Teams should prioritize updating systems that face external network exposure or handle sensitive container images. Begin by identifying all instances of Arcane running versions older than the fixed release. Test the update in a non-production environment to ensure compatibility with existing workflows. Back up current configurations before applying changes to prevent data loss during the upgrade process. Roll out the fix in stages, starting with the most critical infrastructure, to minimize disruption while securing credentials against potential theft.
What to do and how to stay safe: Arcane
- Check your current Arcane version and compare it against the fixed release of 2.5.0.
- Review logs for any unexpected registry URL changes or unauthorized access attempts.
- Rotate any container registry passwords or personal access tokens that may have been exposed.
- Monitor network traffic for connections to unknown or suspicious registry hosts.
Step-by-step guide: Out-of-Band Patches: Meaning, Risks, and Deployment Reality
General security guidance from the Patch Herald newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the severity of CVE-2026-96626?
The vulnerability is rated as HIGH with a CVSS score of 8.5.
Which versions of Arcane are affected?
All versions of the Arcane application prior to version 2.5.0 are affected by this flaw.
Is there a fix available for this vulnerability?
Yes, the issue is fixed in version 2.5.0 of the Arcane application.
