CVE-2026-57169
9.6CriticalPublished 16 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Adjacent network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-306, CWE-862
Impact
Unauthenticated attackers can execute commands inside containers and potentially compromise the host if containers are privileged or have sensitive mounts. They need adjacent network access to Dockhand, a known target container ID, and a container running an interactive shell.
Root cause
The WebSocket upgrade request for the in-browser container terminal endpoint /api/containers/<id>/exec fails to verify authentication.
Affected systems
Dockhand versions prior to 1.0.34
CVSS v3.1 · CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Fix & remediation
Upgrade Dockhand to version 1.0.34 or higher. If patching must wait, block or restrict network access to the Dockhand service or restrict traffic to the /api/containers/*/exec endpoint.
$ docker pull finsys/dockhand:1.0.34AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Dockhand is a Docker management application. Prior to 1.0.34, the in-browser container terminal endpoint /api/containers/<id>/exec does not enforce authentication on the WebSocket upgrade request. When an unauthenticated attacker has network reach to Dockhand, knows a target container ID, and targets a container with an interactive shell, the attacker can open a raw WebSocket terminal session and execute commands inside a known target container. This allows unauthenticated command execution inside the container, with possible host compromise when the container has sensitive mounts or privileged execution. This issue is fixed in version 1.0.34.