CVE-2026-96626

Executive Summary

CVE-2026-96626 is a credential-exposure vulnerability in Arcane, a web interface for managing Docker containers, images, networks, and volumes. Prior to version 2.5.0, the registry update and test functions allow an authenticated user to repoint a container registry URL to an attacker-controlled host without supplying a replacement token, causing the application to decrypt and transmit the previously stored registry credential (a personal access token or password) to that host. Any deployment of Arcane before 2.5.0 that exposes registry-management permissions to non-fully-trusted operators is affected; successful exploitation leaks registry credentials that may enable image access or tampering in downstream registries.

Technical Analysis

The vulnerability resides in Arcane's backend container-registry service, specifically in backend/api/services/container_registry_service.go, within the UpdateRegistry and TestRegistry functions. The design flaw is a mismatch between the lifecycle of the registry URL and the lifecycle of the stored encrypted token. When a user holding the registries:update and registries:test permissions changes a generic registry's URL, the application preserves the existing encrypted token rather than clearing it or requiring re-entry.

The critical missing control is destination validation. The description states that normalizeRegistryServerAddressInternal does not restrict the destination host. Consequently, TestRegistry decrypts the preserved token and RegistryLogin sends it to whatever host the URL now points to. An attacker who can change the registry address to a server they control therefore receives the plaintext credential through a normal "test connection" workflow.

The root cause class is CWE-200 (Exposure of Sensitive Information): a secret is transmitted to an untrusted destination because the code fails to bind the credential to the host it was originally issued for. The CVSS v3.1 vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N (base 8.5) reflects network reachability, low attack complexity, the need for a low-privileged authenticated account, no user interaction, a scope change (impact moves from the Arcane host to the external registry), high confidentiality impact, and low integrity impact. No public proof-of-concept, exploit code, or Nuclei template is currently available, and the vulnerability has not been added to the CISA KEV catalog.

Exploitation Scenarios

No public PoC exists; the following chain is inferred from the NVD description and the vulnerability class.

1. Reconnaissance / target identification. The attacker identifies an Arcane deployment (web UI, typically exposed on an internal management network or occasionally the internet) and obtains an account with at least registries:update and registries:test rights. Such rights may be granted to operators or CI/service accounts that are not fully trusted.

2. Triggering the flaw. The attacker calls the registry-update operation against an existing generic registry and changes its URL to point at a host they control — without providing a new token. Because the token is preserved, the stored credential remains associated with the (now hostile) URL.

3. Payload / execution method. The attacker then invokes the registry-test operation. TestRegistry decrypts the preserved token and RegistryLogin performs a login attempt against the attacker's host, which simply logs the incoming credential. normalizeRegistryServerAddressInternal performs no restriction on the destination, so the exfiltration succeeds as a side effect of a routine "test" action.

4. Post-exploitation impact. The captured PAT or password grants the attacker whatever access the original Arcane service account held on the legitimate registry: pulling private images (confidentiality), and potentially pushing or overwriting tags if the token is write-capable (integrity), enabling supply-chain style image tampering.

Impact Assessment

The primary impact is disclosure of container-registry credentials (C:H). Because these credentials often carry pull and sometimes push rights, exposure can cascade into unauthorized access to private images and, where write access exists, image tampering — consistent with the low integrity impact (I:L) and the scope change (S:C) in the vector, since the effect propagates from the Arcane host to an external registry. Attack complexity is low (AC:L) and no user interaction is required (UI:N), but a low-privileged authenticated account is required (PR:L), limiting exposure to deployments where registry-management permissions are broadly assigned. Blast radius includes any private images and downstream consumers of those images. The EPSS score has not yet been published by FIRST.org.

Detection Guidance

Sigma Rule

title: Arcane Registry URL Repoint and Credential Test to External Host
id: 3f9c2a71-arcn-4b6e-9d1f-96626cve
status: experimental
description: Detects Arcane registry update/test activity consistent with CVE-2026-96626 credential exfiltration via registry URL repointing.
logsource:
  product: arcane
  service: audit
detection:
  selection_registry_change:
    event.action:
      - 'registry.update'
      - 'registries:update'
    registry.url|exists: true
    registry.token_supplied: false
  selection_registry_test:
    event.action:
      - 'registry.test'
      - 'registries:test'
  timeframe: 10m
  condition: selection_registry_change | near selection_registry_test
falsepositives:
  - Legitimate registry reconfiguration followed by connectivity testing
level: high
tags:
  - attack.t1552
  - cve.2026-96626

YARA Rule

rule CVE_2026_96626_Arcane_Registry_Credential_Leak
{
    meta:
        description = "Detects references to the vulnerable Arcane registry service functions associated with CVE-2026-96626"
        cve = "CVE-2026-96626"
        author = "Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-96626"
    strings:
        $f1 = "container_registry_service.go" ascii wide
        $f2 = "normalizeRegistryServerAddressInternal" ascii wide
        $f3 = "RegistryLogin" ascii wide
        $f4 = "TestRegistry" ascii wide
        $f5 = "UpdateRegistry" ascii wide
    condition:
        uint32(0) == 0x464C457F and
        filesize < 200MB and
        ( $f1 or 2 of ($f2, $f3, $f4, $f5) )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-96626 Arcane Registry Test/Update Possible Credential Exfiltration"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/api/"; nocase; http.uri; content:"registry"; nocase; http.uri; content:"test"; nocase; http.request_body; content:"url"; nocase; reference:cve,2026-96626; classtype:attempted-recon; sid:202696626; rev:1;)

Elastic Detection

sequence by user.name with maxspan=10m
  [ any where event.action in ("registry.update","registries:update") and
      registry.token_supplied == false ]
  [ any where event.action in ("registry.test","registries:test") and
      network.direction == "outbound" ]

Splunk SPL Query

index=arcane sourcetype=arcane:audit
( action="registry.update" OR action="registry.test" OR action="registries:update" OR action="registries:test" )
| eval is_update=if(match(action,"update"),1,0)
| eval is_test=if(match(action,"test"),1,0)
| stats sum(is_update) as upd sum(is_test) as tst values(registry_url) as urls
    values(src_ip) as srcs by user, host
| where upd>0 AND tst>0
| table _time user host urls upd tst

Wazuh OSSEC Rule

<group name="arcane,cve-2026-96626">
  <rule id="202696626" level="12">
    <decoded_as>json</decoded_as>
    <field name="action">registry\.(update|test)|registries:(update|test)</field>
    <description>CVE-2026-96626: Arcane registry update/test activity consistent with credential exfiltration</description>
    <mitre>
      <id>T1552</id>
    </mitre>
    <group>credential_access,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations. Restrict the registries:update and registries:test permissions to fully trusted administrators. Treat any registry URL change to an external host as a security event, and rotate/revoke any container-registry PATs or passwords previously stored in Arcane. Block outbound traffic from the Arcane host to unapproved destinations at the network egress.

2. Patch / upgrade steps. Upgrade Arcane to version 2.5.0, which addresses the missing destination restriction. After upgrading, re-key all stored registry credentials.

3. Long-term hardening. Enforce least privilege on registry-management roles, require token re-entry (and host validation) whenever a registry URL changes, and monitor outbound authentication attempts from management tooling to anomalous registries.

References

• NVD — https://nvd.nist.gov/vuln/detail/CVE-2026-96626
• Arcane project repository — https://github.com/ (search "Arcane" Docker management UI)
• MITRE CWE-200 — Exposure of Sensitive Information to an Unauthorized Actor — https://cwe.mitre.org/data/definitions/200.html
• MITRE ATT&CK T1552 — Unsecured Credentials — https://attack.mitre.org/techniques/T1552/

No public proof-of-concept, exploit-in-the-wild evidence, or threat-actor campaign associated with CVE-2026-96626 is currently known; this CVE is not listed in CISA KEV.