CVE-2026-57169 Details
Description
Dockhand is a Docker management application. Prior to 1.0.34, the in-browser container terminal endpoint /api/containers/<id>/exec does not enforce authentication on the WebSocket upgrade request. When an unauthenticated attacker has network reach to Dockhand, knows a target container ID, and targets a container with an interactive shell, the attacker can open a raw WebSocket terminal session and execute commands inside a known target container. This allows unauthenticated command execution inside the container, with possible host compromise when the container has sensitive mounts or privileged execution. This issue is fixed in version 1.0.34.
A vulnerability in Dockhand, a Docker management application, allows for unauthenticated command execution in containers via a WebSocket upgrade. This issue affects versions prior to 1.0.34. The vulnerability arises because the in-browser container terminal endpoint '/api/containers/<id>/exec' does not require authentication for WebSocket upgrade requests. An attacker with network access to Dockhand, knowledge of a target container ID, and access to a container with an interactive shell can exploit this flaw. The exploitation could lead to a compromise of the host system if the container has sensitive mounts or is running with elevated privileges.
Users can upgrade to Dockhand version 1.0.34 or later, which addresses this vulnerability by adding the necessary authentication checks for WebSocket upgrade requests. If an immediate upgrade is not possible, it is recommended to restrict access to Dockhand at the network layer, such as by using a VPN, an external authenticating proxy, or by blocking inbound traffic to Dockhand's port at the firewall.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 16, 2026CISA-ADP
Assessed Oct 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Finsys/dockhand/commit/efb634701c55f80a8c752df8ae08d88f2c16cce9 | [email protected] | Source CodeVendor |
| https://github.com/Finsys/dockhand/releases/tag/v1.0.34 | [email protected] | Release NotesVendor |
| https://github.com/Finsys/dockhand/security/advisories/GHSA-f6q3-chhc-4hxm | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Finsys Dockhand | < 1.0.34 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 28, 2026 | CVE Modified | CISA-ADP |
| Oct 16, 2026 | New CVE Received | [email protected] |