{"schema":"threatline.record/2","record":{"id":"CVE-2026-96626","aliases":["GHSA-9pxc-cxp5-qp54"],"summary":"Arcane: Container-registry credential exfiltration via URL repoint + test to attacker host","details":"Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.5.0, UpdateRegistry and TestRegistry in backend/api/services/container_registry_service.go allow the registry URL to change while preserving the stored encrypted token. When a holder of registries:update and registries:test repoints a generic registry URL without supplying a replacement token, TestRegistry decrypts the preserved token and RegistryLogin sends it to the attacker-controlled host because normalizeRegistryServerAddressInternal does not restrict the destination. This exposes the stored container-registry PAT or password and can enable image access or tampering. This issue is fixed in version 2.5.0.","categories":["Unclassified"],"product":"arcane","vendor":"getarcaneapp","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-96626","source_modified_at":"2026-10-16T21:07:39.570Z","fetched_at":"2026-10-23T18:48:36.087640Z","product":"arcane","vendor":"getarcaneapp","versions":[{"status":"affected","version":"< 2.5.0"}],"defaultStatus":null},{"source":"GitHub Advisory Database","source_url":"https://github.com/getarcaneapp/arcane/security/advisories/GHSA-9pxc-cxp5-qp54","source_modified_at":"2026-09-23T19:41:39Z","fetched_at":"2026-10-23T18:58:35.272684Z","package":{"ecosystem":"go","name":"github.com/getarcaneapp/arcane/backend"},"range":"<= 2.4.0"}],"fixed_versions":[],"cvss":8.5,"severity":"High","kev":{"listed":false},"epss":{"probability":0.00216,"percentile":0.11451,"score_date":"2026-10-23"},"published_at":"2026-10-16T21:07:39.570Z","modified_at":"2026-10-16T21:07:39.570Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-96626","fetched_at":"2026-10-23T18:48:36.087640Z","source_modified_at":"2026-10-16T21:07:39.570Z"},{"source":"GitHub Advisory Database","url":"https://github.com/getarcaneapp/arcane/security/advisories/GHSA-9pxc-cxp5-qp54","fetched_at":"2026-10-23T18:58:35.272684Z","source_modified_at":"2026-09-23T19:41:39Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96626","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","GitHub Advisory Database","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/getarcaneapp/arcane/security/advisories/GHSA-9pxc-cxp5-qp54","tags":["x_refsource_CONFIRM"]},{"source":"CVE List","url":"https://github.com/getarcaneapp/arcane/pull/3317","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/getarcaneapp/arcane/commit/fe31693634f48f295a7d77d091085b331cf9e915","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/getarcaneapp/arcane/releases/tag/backend/v2.5.0","tags":["x_refsource_MISC"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-16T21:07:39.570Z","content_hash":"0e719d3b78fab2fefa3847a557f530431dc645b1bc420083fb9b9ada6b35d52a"}}