CVE-2026-57169

CRITICAL 9.6

Dockhand: Unauthenticated container exec via WebSocket upgrade

CVSS Score

9.6

EPSS Score

0.0%

EPSS Percentile

0th

Dockhand is a Docker management application. Prior to 1.0.34, the in-browser container terminal endpoint /api/containers/<id>/exec does not enforce authentication on the WebSocket upgrade request. When an unauthenticated attacker has network reach to Dockhand, knows a target container ID, and targets a container with an interactive shell, the attacker can open a raw WebSocket terminal session and execute commands inside a known target container. This allows unauthenticated command execution inside the container, with possible host compromise when the container has sensitive mounts or privileged execution. This issue is fixed in version 1.0.34.

CWE	CWE-306 CWE-862
Vendor	finsys
Product	dockhand
Published	Oct 16, 2026

Stay Ahead of the Next One

Get instant alerts for finsys dockhand

Be the first to know when new critical vulnerabilities affecting finsys dockhand are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

Finsys / dockhand

< 1.0.34

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/Finsys/dockhand/security/advisories/GHSA-f6q3-chhc-4hxm github.com: https://github.com/Finsys/dockhand/commit/efb634701c55f80a8c752df8ae08d88f2c16cce9 github.com: https://github.com/Finsys/dockhand/releases/tag/v1.0.34