‹ Back to list

CVE-2026-57169

Status: DeferredCritical (9.6)—
Severity9.6Critical · CVSS 3.1
Exploitation probability0.30 %higher than 22% of CVEs
Active exploitationNonot in the CISA catalog
Public exploitNot knownno public code found

Dockhand is a Docker management application. Prior to 1.0.34, the in-browser container terminal endpoint /api/containers/<id>/exec does not enforce authentication on the WebSocket upgrade request. When an unauthenticated attacker has network reach to Dockhand, knows a target container ID, and targets a container with an interactive shell, the attacker can open a raw WebSocket terminal session and execute commands inside a known target container. This allows unauthenticated command execution inside the container, with possible host compromise when the container has sensitive mounts or privileged execution. This issue is fixed in version 1.0.34.

CVSS

Base score
9.6
Version
3.1
Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Exploitation probability (EPSS)

Probability of exploitation in the next 30 days
0.30 %
Percentile among all scored CVEs
22
Score date
10/20/2026

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

ATT&CK techniques

How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.

Vector AV:A/PR:N/UI:N y CWE-306: el WebSocket de /api/containers/<id>/exec no exige autenticación, permitiendo ejecutar comandos en el contenedor; el escape al host es solo posible con montajes sensibles.

Inferred by our analysis agent from the official description, CVSS vector and CWE, and checked by a supervisor. May contain errors.

ATT&CK mitigations that cover these techniques

Privileged Account ManagementDisable or Remove Feature or ProgramExecution PreventionApplication Isolation and SandboxingUpdate SoftwareVulnerability Scanning

Affected technologies (1)

⚠ AI-inferred from the description — NVD hasn't analyzed this CVE yet, these aren't verified CPEs.

Dockhand — DockhandAI

CWEs

References

Show 3 references

Raw JSON (NVD)

Show
{
  "id": "CVE-2026-57169",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 9.6,
          "attackVector": "ADJACENT_NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "Finsys",
          "product": "dockhand",
          "versions": [
            {
              "status": "affected",
              "version": "< 1.0.34"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-10-16T17:17:35.113",
  "references": [
    {
      "url": "https://github.com/Finsys/dockhand/commit/efb634701c55f80a8c752df8ae08d88f2c16cce9",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/Finsys/dockhand/releases/tag/v1.0.34",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/Finsys/dockhand/security/advisories/GHSA-f6q3-chhc-4hxm",
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-306"
        },
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Dockhand is a Docker management application. Prior to 1.0.34, the in-browser container terminal endpoint /api/containers/<id>/exec does not enforce authentication on the WebSocket upgrade request. When an unauthenticated attacker has network reach to Dockhand, knows a target container ID, and targets a container with an interactive shell, the attacker can open a raw WebSocket terminal session and execute commands inside a known target container. This allows unauthenticated command execution inside the container, with possible host compromise when the container has sensitive mounts or privileged execution. This issue is fixed in version 1.0.34."
    }
  ],
  "lastModified": "2026-10-16T20:04:29.760",
  "sourceIdentifier": "security-advisories@github.com"
}