Read the docs
TI-2026-84331 Aliases CVE-2026-121449GHSA-vvw2-c8c7-h7pp

Secret disclosure in Dockhand via Git stack webhook

Priority MEDIUM 64CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-200.

Summary

Finsys Dockhand from 1.0.47 before 1.0.54 exposes plaintext stack secrets through Git-stack routes (CWE-200). The deployStack() function attaches resolved secret values to its result, which these routes return unfiltered. A holder of a stack's webhook secret or a user with stacks:start permission can call the Git stack webhook, manual deploy, or create-and-deploy endpoints to receive stored and external-provider values such as 1Password or Vault secrets.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

Description from the CNA

Dockhand from 1.0.47 before 1.0.54 exposes plaintext stack secrets because deployStack() attaches resolved secret values to its result as resolvedSecrets, which Git-stack routes return unfiltered. Holders of a stack's webhook secret or users with stacks:start permission can trigger the Git stack webhook, manual deploy, or create-and-deploy endpoints to receive stored and external-provider secrets such as 1Password or Vault values.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00404 34th percentileScored 2026-11-07
Fix Fixed dockhand (Finsys): 1.0.54

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Finsysdockhand1.0.47 to before 1.0.541.0.54Patch availableCNA
  • dockhand VendorFinsys Affected 1.0.47 to before 1.0.54 Fixed in 1.0.54 Patch available CNA

Remediation

Update Finsys Dockhand to version 1.0.54, the fixed version listed for this issue.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

  • Fix · CNA dockhand (Finsys) Fixed in 1.0.54

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Finsys dockhand 1.0.54

    2 records Highest priority Priority MEDIUM 2 MEDIUM

    Other records, highest priority first

    • TI-2026-84330 Path traversal in Dockhand lets users access .env files outside stacks rootPriority MEDIUM 40
    Show all 2 records →

Timeline

  1. 2026-11-03 Threatist record created from CVE-2026-121449
  2. 2026-11-03 Alias added: GHSA-vvw2-c8c7-h7pp
  3. 2026-11-03 CISA SSVC decision points changed

References

Patch 1

Advisory 1

  • TI-2026-73418 Authentication bypass in Finsys Dockhand via static-asset check CVSS 4.0CRITICAL 10.0
  • TI-2026-73458 Server-side request forgery in Finsys Dockhand template endpoint CVSS 4.0HIGH 8.4
  • TI-2026-76803 Dockhand Arbitrary File Read via /api/system/files/content CVSS 4.0HIGH 7.1
  • TI-2026-73459 LDAP injection in Dockhand enables username enumeration CVSS 4.0MEDIUM 6.3
  • TI-2026-75363 Unauthenticated command execution in Dockhand container terminal CVSS 3.1CRITICAL 9.6
  • TI-2026-73417 Finsys Dockhand OIDC privilege escalation via missing claim checks CVSS 4.0CRITICAL 9.2
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences