CVE-2026-57169
Received Received - Intake

Unauthenticated Command Execution in Dockhand Docker Management App

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: GitHub, Inc.

Description
Dockhand is a Docker management application. Prior to 1.0.34, the in-browser container terminal endpoint /api/containers/<id>/exec does not enforce authentication on the WebSocket upgrade request. When an unauthenticated attacker has network reach to Dockhand, knows a target container ID, and targets a container with an interactive shell, the attacker can open a raw WebSocket terminal session and execute commands inside a known target container. This allows unauthenticated command execution inside the container, with possible host compromise when the container has sensitive mounts or privileged execution. This issue is fixed in version 1.0.34.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-57169
EUVD
EUVD-2026-102920

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Finsys dockhand < 1.0.34

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-57169 is a critical vulnerability in Dockhand, a Docker management application. It allows unauthenticated attackers with network access to execute commands inside any container managed by Dockhand. The flaw exists in the WebSocket upgrade endpoint for the in-browser container terminal, which did not enforce authentication during the upgrade process.

Detection Guidance

Check if Dockhand is running version 1.0.34 or later. Inspect network traffic for unauthenticated WebSocket connections to /api/containers/<id>/exec endpoints. Monitor logs for unexpected container terminal sessions or command executions.

Impact Analysis

An attacker could gain full control over containers with sensitive data or privileged execution, potentially leading to host system compromise. This includes accessing confidential information, modifying data, or disrupting services. The impact depends on the container's configuration and permissions.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements. Organizations may face compliance breaches, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Upgrade Dockhand to version 1.0.34 or later immediately. Restrict network access to Dockhand via VPN, LAN-only networks, external authenticating proxies, or firewall rules until upgraded.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-57169. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart