CVE-2026-96626

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.5.0, UpdateRegistry and TestRegistry in backend/api/services/container_registry_service.go allow the registry URL to change while preserving the stored encrypted token. When a holder of registries:update and registries:test repoints a generic registry URL without supplying a replacement token, TestRegistry decrypts the preserved token and RegistryLogin sends it to the attacker-controlled host because normalizeRegistryServerAddressInternal does not restrict the destination. This exposes the stored container-registry PAT or password and can enable image access or tampering. This issue is fixed in version 2.5.0.

• CWE-200
• CWE-522

• https://github.com/getarcaneapp/arcane/commit/fe31693634f48f295a7d77d091085b331cf9e915
• https://github.com/getarcaneapp/arcane/pull/3317
• https://github.com/getarcaneapp/arcane/releases/tag/backend/v2.5.0
• https://github.com/getarcaneapp/arcane/security/advisories/GHSA-9pxc-cxp5-qp54

Published

Oct 16, 2026

Last Modified

Oct 16, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-96613The Meari IoT Cloud Platform OpenAPI Service is vulnerable t…6.5
• CVE-2026-96614"ゲオアプリ" provided by GEO CORPORATION is vulnerable to imprope…5.1
• CVE-2026-96615Description NGINX Gateway Fabric has a vulnerability when it…6.5
• CVE-2026-96618Improper Handling of Highly Compressed Data (Data Amplificat…2.1
• CVE-2026-9662The Recover Exit For WooCommerce plugin for WordPress is vul…8.1
• CVE-2026-96620Claude Agent SDK is a Python SDK for Claude Code. Prior to 0…9.2
• CVE-2026-96627Arcane is an interface for managing Docker containers, image…8.8
• CVE-2026-96628Arcane is an interface for managing Docker containers, image…4.3
• CVE-2026-96647The Listdom: AI-powered Business Directory with Classifieds …6.4
• CVE-2026-96648The Data Tables Generator by Supsystic plugin for WordPress …6.4
• CVE-2026-96649The Frontend Post Submission Manager Lite – Frontend Posting…7.2
• CVE-2026-96650The Strong Testimonials plugin for WordPress is vulnerable t…7.2