Unauthenticated OS Command Injection Vulnerability in Dockwatch by Notifiarr

CVE-2026-58455

What is CVE-2026-58455?

CVE-2026-58455 is a critical vulnerability affecting the Dockwatch software developed by Notifiarr, particularly in version 0.6.567. Dockwatch is a tool designed for monitoring and managing Docker containers, facilitating ease of use and automation for containerized environments. This vulnerability arises from an unauthenticated OS command injection flaw that allows remote attackers to execute arbitrary shell commands. The vulnerability is rooted in an incomplete authentication check in the loader.php file, coupled with unsanitized inputs being passed to the shell_exec() function in ajax/compose.php. By exploiting this flaw, attackers can leverage the incomplete authentication process to execute potentially harmful commands, leading to a full compromise of the host system, especially given the typical deployment configuration involving the Docker socket.

Potential impact of CVE-2026-58455

1. Remote Code Execution: This vulnerability grants attackers the ability to execute arbitrary commands on the host system remotely, which could lead to full system takeover, data loss, or destructive changes to the environment.

2. Compromise of Confidential Data: If exploited, attackers could access and manipulate sensitive data stored within the containerized environment, posing a significant risk to organizational confidentiality and integrity.

3. Wider Network Vulnerabilities: The ability to execute commands can allow attackers to establish footholds within the network, potentially leading to lateral movement and further breaches of other systems connected to the compromised host.

References