Missing Authentication in Docker-Proxy Affects Configuration Access

CVE-2026-116070

What is CVE-2026-116070?

The Docker-Proxy application through version 5.1.9 is affected by a missing authentication vulnerability in the hubcmdui routes/config.js file. This security issue permits unauthenticated attackers to gain access to sensitive configuration data. Specifically, attackers can exploit the /api/config endpoint, allowing them to read sensitive information such as the WeChat webhook URL and Telegram bot token. Moreover, the configuration manipulation capability enables unauthorized changes to important settings, including menuItems links and the monitoring webhook destination, creating significant security risks for users.

References