CVE-2026-116070
Received Received - Intake

Docker-Proxy Missing Authentication in Configuration API

Publication date: 2026-10-25

Last updated on: 2026-10-25

Assigner: VulnCheck

Description
Docker-Proxy through 5.1.9 contains a missing authentication vulnerability in the hubcmdui routes/config.js that allows unauthenticated attackers to read and overwrite configuration via /api/config. Attackers can retrieve the WeChat webhook URL and Telegram bot token, and overwrite menuItems links, proxyDomain, and the monitoring webhook destination receiving alerts.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-25
Last Modified
2026-10-25
Generated
2026-10-25
AI Q&A
2026-10-25
EPSS Evaluated
N/A
NVD
CVE-2026-116070
EUVD
EUVD-2026-109384

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
dqzboy Docker-Proxy 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Docker-Proxy through version 5.1.9 has a missing authentication vulnerability in the hubcmdui routes/config.js file. This flaw allows unauthenticated attackers to read and overwrite configuration settings via the /api/config endpoint. Attackers can retrieve sensitive data like WeChat webhook URLs and Telegram bot tokens, and modify configurations such as menu links, proxy domain, and monitoring webhook destinations.

Detection Guidance

Check if the /api/config endpoint is accessible without authentication by sending a GET request to http://<target-ip>:<port>/api/config. If it returns configuration data, the system is vulnerable. Use curl -X GET http://<target-ip>:<port>/api/config to test.

Impact Analysis

This vulnerability allows attackers to read sensitive configuration data and modify critical settings without authentication. Potential impacts include exposure of webhook URLs and bot tokens, redirection of monitoring alerts to attacker-controlled destinations, defacement of navigation menus, and unauthorized changes to proxy configurations. The attacker could also disable monitoring or alter alert destinations.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA by exposing sensitive data such as webhook URLs and bot tokens, which may contain personal or confidential information. Unauthorized access to monitoring configurations could also result in failure to meet data protection and audit requirements, potentially leading to regulatory penalties.

Mitigation Strategies

Upgrade Docker-Proxy to a version that includes the security fix. If upgrading is not possible, restrict access to the /api/config endpoint via network firewall rules or reverse proxy configurations. Change default credentials immediately.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-116070. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart