Threat Intelligence Database

Dockhand, a Docker management application by Finsys, has a critical vulnerability (CVE-2026-57169) in versions prior to 1.0.34. The vulnerability is due to missing authentication enforcement on the WebSocket upgrade request for the in-browser container terminal endpoint (/api/containers/<id>/exec). An unauthenticated attacker with network access and knowledge of a container ID can open a raw WebSocket terminal session and execute commands inside that container. This can lead to unauthenticated command execution within the container and potential host compromise if the container has sensitive mounts or privileged execution. The issue is fixed in version 1.0.34.

Finsys Dockhand versions before 1.0.19 contain an LDAP injection vulnerability in the tryLdapAuth function. This flaw allows unauthenticated attackers to submit crafted wildcard patterns in login requests to enumerate valid LDAP usernames by measuring response timing. The vulnerability arises because the login username is inserted into the LDAP search filter without properly escaping wildcard characters.

CVE-2026-110255 is a server-side request forgery (SSRF) vulnerability in Finsys Dockhand versions before 1.0.43. Authenticated users can exploit this flaw by supplying repository URL and stackfile values that cause the server to fetch arbitrary URLs. This can lead to exposure of sensitive internal service data or cloud metadata endpoints, including credentials and tokens, via the compose response field.

Finsys Dockhand before 1.0.45 contains a server-side request forgery vulnerability in the ipCategory() function in src/lib/server/url-safety.ts, which fails to check NAT64, 6to4, and Teredo IPv6 transition ranges. Authenticated attackers can embed loopback, cloud metadata, or private IPv4 addresses in transition IPv6 literals within notification, backup, template, registry, git, or secret provider URLs to reach internal services.

Dockhand before 1.0.45 contains an authentication bypass in which the global auth hook skips authentication for any path ending in a static-asset extension such as .js, including /api/* routes, and the user-mutation handlers fail open for unauthenticated callers. Unauthenticated remote attackers can send a PUT request to /api/users/<id>.js to reset the admin's or any user's password and take over the account.

Dockhand before version 1.0.50 has a critical privilege escalation vulnerability due to improper validation of OIDC claims (iss, aud, nonce, exp). This flaw allows users from a different tenant in a shared identity provider environment, such as Microsoft Entra ID, to gain administrative access by recreating the mapped admin group and logging in as Dockhand administrators.

Dockhand versions before 1.0.40 have an authentication bypass vulnerability in their git webhook endpoints. This flaw allows unauthenticated remote attackers to trigger arbitrary stack redeployments by exploiting a missing webhook secret check. Attackers can enumerate stack IDs and send unsigned webhook requests to force git clone and docker compose operations, potentially causing denial of service or, if combined with write access to the git branch, container escape and full host compromise.

Dockhand versions before 1.0.36 have an open redirect vulnerability in the OIDC initiation endpoint. This flaw allows unauthenticated attackers to redirect authenticated users to malicious sites by manipulating a redirect query parameter. Exploitation can lead to capturing authorization codes through the Referer header and enable credential phishing attacks targeting Dockhand accounts after legitimate logins. The vulnerability has a medium severity with a CVSS score of 5.3.