CVE-2026-96626: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor in getarcaneapp arcane

Arcane, a Docker management interface, has a vulnerability (CVE-2026-96626) in versions before 2.5.0 where the UpdateRegistry and TestRegistry functions allow changing the registry URL while preserving the encrypted token. If an attacker with registries:update and registries:test permissions repoints a generic registry URL without providing a new token, the system decrypts and sends the preserved token to the attacker-controlled host. This is due to the lack of restrictions in normalizeRegistryServerAddressInternal on the destination address. The exposed token can be a container-registry personal access token or password, enabling unauthorized image access or tampering. The vulnerability is resolved in version 2.5.0.

An attacker with specific registry permissions can obtain sensitive authentication tokens by redirecting registry URLs to attacker-controlled hosts. This exposure can lead to unauthorized access to container images or tampering with them. The confidentiality of stored container-registry personal access tokens or passwords is compromised. There is no indication of impact on availability or integrity beyond image tampering.

This vulnerability is fixed in Arcane version 2.5.0. Users should upgrade to version 2.5.0 or later to remediate this issue. No alternative mitigations are indicated in the advisory.