CVE-2026-96626

{
  "etk_id": "ETK-2026-1815",
  "cve_id": "CVE-2026-96626",
  "display_id": "CVE-2026-96626",
  "ghsa_id": "GHSA-9pxc-cxp5-qp54",
  "euvd_id": "EUVD-2026-103175",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Arcane registry credential exfiltration",
  "summary": "Arcane releases before 2.5.0 can send a saved container-registry credential to an altered registry endpoint during registry testing. An attacker needs registry update and test permissions and an existing stored credential to redirect the authentication attempt, potentially gaining access to container images.",
  "mitigation": "Upgrade Arcane to version 2.5.0 or later. Restrict registry update and test permissions until the upgrade is complete.",
  "vendor": "getarcaneapp",
  "product": "arcane",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "<= 2.4.0"
      ],
      "ecosystem": "go",
      "fixed_versions": [
        "v2.5.0"
      ],
      "package_name": "github.com/getarcaneapp/arcane/backend",
      "purl": "pkg:golang/github.com/getarcaneapp/arcane/backend"
    }
  ],
  "cwes": [
    200
  ],
  "cvss_score": 8.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N",
  "epss_score": 0.0022,
  "epss_percentile": 0.1136,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": true,
  "check_confidence_basis": "assessed",
  "exploit": false,
  "pipeline_minutes": 31.615723433333333,
  "t0_at": "2026-10-16T21:07:39.570000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-16T22:19:14.827792+00:00",
      "days": 0.049713631851851854,
      "is_lower_bound": false,
      "measured_at": "2026-10-16T21:07:39.570000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-16T21:07:39.570000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-16T21:07:39.570000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-96626"
    }
  }
}