Authentication Bypass in Dockhand Docker Management Application
CVE-2026-57169

9.6CRITICAL

Key Information:

Vendor

Finsys

Status
Dockhand
Vendor
CVE Published:
16 October 2026

What is CVE-2026-57169?

Dockhand is a Docker management application that was found to have an authentication bypass vulnerability in its in-browser container terminal endpoint. Prior to version 1.0.34, the endpoint /api/containers//exec did not require authentication for WebSocket upgrade requests. This allowed unauthorized access, enabling an attacker with network reach to execute commands within targeted containers by opening a raw WebSocket terminal session. If the targeted container is configured with sensitive mounts or running with elevated privileges, this vulnerability could lead to severe security risks, including potential exposure of host systems. The issue has been addressed and mitigated in version 1.0.34.

Affected Version(s)

dockhand < 1.0.34

References

https://github.com/Finsys/dockhand/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/Finsys/dockhand/commit/efb634701c55f80...
x_refsource_MISC
https://github.com/Finsys/dockhand/releases/tag/v1.0.34
x_refsource_MISC

CVSS V3.1

Score:
9.6
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.