Vulnerability details
CVE-2026-57169
Finsys dockhand
Dockhand: Unauthenticated container exec via WebSocket upgrade
CVSS 3.1
9.6Critical
Official description
Dockhand is a Docker management application. Prior to 1.0.34, the in-browser container terminal endpoint /api/containers/<id>/exec does not enforce authentication on the WebSocket upgrade request. When an unauthenticated attacker has network reach to Dockhand, knows a target container ID, and targets a container with an interactive shell, the attacker can open a raw WebSocket terminal session and execute commands inside a known target container. This allows unauthenticated command execution inside the container, with possible host compromise when the container has sensitive mounts or privileged execution. This issue is fixed in version 1.0.34.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 9.6Critical | 3.1 | CVEProject cvelistV5 (CNA) (GitHub_M) | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| Finsys | dockhand | < 1.0.34 | CVEProject cvelistV5 (CNA) |
References and advisories
3- https://github.com/Finsys/dockhand/security/advisories/GHSA-f6q3-chhc-4hxm x_refsource_CONFIRM
- https://github.com/Finsys/dockhand/commit/efb634701c55f80a8c752df8ae08d88f2c16cce9 x_refsource_MISC
- https://github.com/Finsys/dockhand/releases/tag/v1.0.34 x_refsource_MISC
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-10-16
- Last updated
- 2026-10-28
- State
- Published
- Assigner (CNA)
- GitHub_M
- Kolun priority
- 20 · Low
Exploit prediction (EPSS)
0.3%
Probability of exploitation in 30 days
23.3%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- None
- Technical impact
- Total
Weaknesses (CWE)
- CWE-306Missing Authentication for Critical Function
- CWE-862Missing Authorization