CVE-2026-53988 is an authentication bypass vulnerability affecting Finsys dockhand versions prior to 1.0.40. The vulnerability exists in the git webhook endpoints where a null webhook secret guard condition allows unauthenticated remote attackers to trigger arbitrary stack redeployments. Attackers can enumerate sequential stack IDs and send unsigned webhook requests, causing forced git clone and docker compose operations. This can result in denial of service or, when combined with write access to the tracked git branch, container escape and full host compromise through attacker-controlled docker-compose.yml files with privileged bind mounts.

The vulnerability enables unauthenticated attackers to remotely trigger stack redeployments without authorization. This can cause denial of service by forcing unwanted operations. More critically, if the attacker also has write access to the tracked git branch, they can achieve container escape and full host compromise by supplying malicious docker-compose.yml files with privileged bind mounts, potentially leading to complete system takeover.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to git webhook endpoints and monitor for unauthorized webhook requests. Limit write access to the tracked git branch to trusted users only to reduce risk of container escape and host compromise.