Threat database

Dockhand before 1.0.46 contains an arbitrary file read vulnerability that allows non-admin users with stacks:edit permission to read files through the path parameter of /api/system/files/content. Attackers can supply absolute paths to read /etc/shadow, /etc/passwd, git .git/config credentials, and SSH keys from the Dockhand container.

Dockhand, a Docker management application by Finsys, has a critical vulnerability (CVE-2026-57169) affecting versions prior to 1.0.34. The flaw is due to missing authentication on the WebSocket upgrade request for the in-browser container terminal endpoint, allowing unauthenticated attackers with network access and container ID knowledge to execute commands inside containers. This can lead to full container compromise and potentially the host if privileged or sensitive mounts are present. The vulnerability is fixed in version 1.0.34.

Finsys Dockhand versions before 1.0.19 contain an LDAP injection vulnerability in the tryLdapAuth function. This flaw allows unauthenticated attackers to submit crafted wildcard patterns in login requests to enumerate valid LDAP usernames by measuring response timing. The vulnerability arises because the login username is inserted into the LDAP search filter without properly escaping wildcard characters.

CVE-2026-110255 is a server-side request forgery (SSRF) vulnerability in Finsys Dockhand versions before 1.0.43. Authenticated users can exploit this flaw by supplying repository URL and stackfile values that cause the server to fetch arbitrary URLs. This can lead to exposure of sensitive internal service data or cloud metadata endpoints, including credentials and tokens, via the compose response field.

CVE-2026-110254 is a server-side request forgery (SSRF) vulnerability in Finsys Dockhand versions before 1.0.45. The flaw exists in the ipCategory() function, which does not properly validate certain IPv6 transition ranges such as NAT64, 6to4, and Teredo. Authenticated attackers can exploit this by embedding loopback, cloud metadata, or private IPv4 addresses within IPv6 literals in various URL parameters, potentially allowing internal service access.

Dockhand versions before 1.0.45 have an authentication bypass vulnerability where requests to paths ending with static-asset extensions like .js bypass global authentication checks. This flaw allows unauthenticated remote attackers to send specially crafted PUT requests to endpoints such as /api/users/<id>.js to reset passwords of any user, including administrators, enabling account takeover.

Dockhand versions before 1.0.50 have a critical privilege escalation vulnerability due to improper validation of OIDC claims (iss, aud, nonce, exp). This flaw allows users from other tenants in a shared identity provider environment to gain admin access by recreating the mapped admin group and logging in as administrators.

Dockhand versions before 1.0.40 have an authentication bypass vulnerability in their git webhook endpoints. This flaw allows unauthenticated remote attackers to trigger arbitrary stack redeployments by exploiting a missing webhook secret check. Attackers can enumerate stack IDs and send unsigned webhook requests to force git clone and docker compose operations, potentially causing denial of service or, if combined with write access to the git branch, container escape and full host compromise.

Dockhand versions before 1.0.36 have an open redirect vulnerability in the OIDC initiation endpoint. This flaw allows unauthenticated attackers to redirect authenticated users to malicious sites by manipulating a redirect query parameter. Exploitation can lead to capturing authorization codes through the Referer header and enable credential phishing attacks targeting Dockhand accounts after legitimate logins. The vulnerability has a medium severity with a CVSS score of 5.3.