Read the docs
TI-2026-75363 Aliases CVE-2026-57169

Unauthenticated command execution in Dockhand container terminal

Priority MEDIUM 43CWE-306Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-306.

Summary

Dockhand, a Docker management application, does not enforce authentication on the WebSocket upgrade request for its in-browser container terminal endpoint, /api/containers/<id>/exec, prior to 1.0.34. An unauthenticated attacker with network access to Dockhand who knows a target container ID can open a raw WebSocket terminal and run commands in a container that has an interactive shell. If that container has sensitive mounts or runs privileged, the attacker may also compromise the host. The CVSS 3.1 base score is 9.6 (Critical), mapped to CWE-306 and CWE-862.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Dockhand is a Docker management application. Prior to 1.0.34, the in-browser container terminal endpoint /api/containers/<id>/exec does not enforce authentication on the WebSocket upgrade request. When an unauthenticated attacker has network reach to Dockhand, knows a target container ID, and targets a container with an interactive shell, the attacker can open a raw WebSocket terminal session and execute commands inside a known target container. This allows unauthenticated command execution inside the container, with possible host compromise when the container has sensitive mounts or privileged execution. This issue is fixed in version 1.0.34.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00304 23rd percentileScored 2026-11-07
Fix Fixed dockhand (Finsys): 1.0.34

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Finsysdockhandbefore 1.0.341.0.34Patch availableCNA
  • dockhand VendorFinsys Affected before 1.0.34 Fixed in 1.0.34 Patch available CNA

Remediation

Upgrade Finsys Dockhand to version 1.0.34, which fixes this issue.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA dockhand (Finsys) Fixed in 1.0.34

Timeline

  1. 2026-10-16 Threatist record created from CVE-2026-57169
  2. 2026-10-28 CISA SSVC decision points changed

References

Other 3

  • TI-2026-73418 Authentication bypass in Finsys Dockhand via static-asset check CVSS 4.0CRITICAL 10.0
  • TI-2026-73458 Server-side request forgery in Finsys Dockhand template endpoint CVSS 4.0HIGH 8.4
  • TI-2026-84331 Secret disclosure in Dockhand via Git stack webhook CVSS 4.0HIGH 7.1
  • TI-2026-76803 Dockhand Arbitrary File Read via /api/system/files/content CVSS 4.0HIGH 7.1
  • TI-2026-73459 LDAP injection in Dockhand enables username enumeration CVSS 4.0MEDIUM 6.3
  • TI-2026-73417 Finsys Dockhand OIDC privilege escalation via missing claim checks CVSS 4.0CRITICAL 9.2
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences