Authentication Bypass in Dockhand Webhook Endpoints

CVE-2026-53988

What is CVE-2026-53988?

Dockhand versions prior to 1.0.40 are susceptible to an authentication bypass vulnerability through their git webhook endpoints. This flaw allows unauthenticated attackers to initiate arbitrary stack redeployments by exploiting a vulnerability in the webhook secret guard condition. Attackers can easily enumerate stack IDs and send unsigned webhook requests, which may lead to denial of service. If the attacker also has write access to the corresponding git branch, they could leverage this vulnerability to facilitate container escape and potentially gain full control over the host system by manipulating the docker-compose.yml file with privileged bind mounts.

References