Vulnerability in Docker Container Management Interface by Arcane

CVE-2026-96626

What is CVE-2026-96626?

Arcane, a tool designed to manage Docker containers, images, networks, and volumes, has a vulnerability that allows an attacker to exploit the UpdateRegistry and TestRegistry functionalities. Prior to version 2.5.0, the system permits a generic registry URL to be modified without necessitating a replacement of the associated encrypted token. This flaw emerges when a user with permission to update or test registries changes the registry URL, resulting in TestRegistry decrypting the stored token inadvertently. Consequently, this decrypted token is transmitted to a potentially malicious host because the normalization function does not constrain the destination address. This poses a risk as it exposes sensitive credentials, including container-registry personal access tokens or passwords, which can lead to unauthorized access or tampering with Docker images. The issue has been addressed in version 2.5.0.

References