Secret Disclosure Vulnerability in Dockhand by Finsys
CVE-2026-121449

7.1HIGH

Key Information:

Vendor

Finsys

Status
Dockhand
Vendor
CVE Published:
3 November 2026

What is CVE-2026-121449?

Dockhand versions prior to 1.0.54 contain a vulnerability that allows unauthorized users to access plaintext secrets due to improper handling of resolved secret values in the deployStack() function. This issue arises because the Git stack webhook and associated endpoints can be triggered by holders of a stack's webhook secret or users with certain permissions. As a result, sensitive information from external providers, such as 1Password or Vault, could be exposed, posing a significant risk to security.

Affected Version(s)

dockhand 1.0.47 < 1.0.54

dockhand 1.0.54

References

https://github.com/Finsys/dockhand/security/advisories/GH...
vendor-advisory
https://github.com/Finsys/dockhand/commit/a08843a8d5ab1d9...
patch
https://www.vulncheck.com/advisories/dockhand-1.0.47-befo...
third-party-advisory

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

2xffwd
.