CVE-2026-27734 Beszel Vulnerable to Docker API Path Traversal via Unsanitized Container ID
Authenticated users can traverse Docker API paths to expose sensitive infrastructure details due to unsanitized container IDs.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-27734?
CVE-2026-27734 is a medium-severity path traversal vulnerability in henrygd beszel, published on 27 Feb 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Beszel is a server monitoring platform. Prior to version 0.18.2, the hub's authenticated API endpoints GET /api/beszel/containers/logs and GET /api/beszel/containers/info pass the user-supplied "container" query parameter to the agent without validation. The agent constructs Docker Engine API URLs using fmt.Sprintf with the raw value instead of url.PathEscape(). Since Go's http.Client does not sanitize `../` sequences from URL paths sent over unix sockets, an authenticated user (including readonly role) can traverse to arbitrary Docker API endpoints on agent hosts, exposing sensitive infrastructure details. Version 0.18.4 fixes the issue.
Weakness: CWE-22
Which versions are affected by CVE-2026-27734?
3 open source packages ship an affected version, including github.com/henrygd/beszel. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/henrygd/beszel Go | All versions | 0.18.4 |
github.com/henrygd/beszel Go | All versions | 0.18.4 |
github.com/henrygd/beszel Go | All versions | 0.18.4 |
Products include Beszel Beszel.
How do I fix CVE-2026-27734?
Upgrade github.com/henrygd/beszel to 0.18.4 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-27734 being exploited?
There is no known exploitation of CVE-2026-27734 in the wild and no public exploit code.
Other vulnerabilities in henrygd beszel
Sources
Also known as GHSA-phwh-4f42-gwf3, GO-2026-4571.