Threat database

Docker-Proxy versions up to 5.1.9 have a missing authentication vulnerability in the hubcmdui routes/config.js component. This flaw allows unauthenticated attackers to read and overwrite configuration data via the /api/config endpoint. Sensitive information such as the WeChat webhook URL and Telegram bot token can be exposed, and attackers can modify menuItems links, proxyDomain, and monitoring webhook destinations.