CVE-2026-57169 Dockhand: Unauthenticated container exec via WebSocket upgrade
Unauthenticated attackers can execute commands in Docker containers via an unprotected WebSocket endpoint, potentially leading to host compromise.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-57169?
CVE-2026-57169 is a critical missing authorization vulnerability in Finsys dockhand, published on 16 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Dockhand is a Docker management application. Prior to 1.0.34, the in-browser container terminal endpoint /api/containers/<id>/exec does not enforce authentication on the WebSocket upgrade request. When an unauthenticated attacker has network reach to Dockhand, knows a target container ID, and targets a container with an interactive shell, the attacker can open a raw WebSocket terminal session and execute commands inside a known target container. This allows unauthenticated command execution inside the container, with possible host compromise when the container has sensitive mounts or privileged execution. This issue is fixed in version 1.0.34.
Which versions are affected by CVE-2026-57169?
How do I fix CVE-2026-57169?
No fix has been published for CVE-2026-57169 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-57169 being exploited?
There is no known exploitation of CVE-2026-57169 in the wild and no public exploit code.
Sources
Also known as GHSA-f6q3-chhc-4hxm.