Live › vulnerability › CVE-2026-116070
Go to dashboardDocker-Proxy through 5.1.9 has a missing authentication check in its hubcmdui config route, so anyone can call /api/config. An attacker can read the WeChat webhook URL and Telegram bot token and overwrite menu links, the proxy domain and the alert webhook destination.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-25 12:40 UTC. All times on this page are UTC.
Teams that run Docker-Proxy 5.1.9 or earlier with the hubcmdui component exposed to a network the attacker can reach. The sources do not say whether a default install exposes the route, so the exposure is unknown.
No product ranges from the sources yet.
/api/config without logging in and see whether it returns configuration data (unknown if the sources give a specific check)Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Docker-Proxy through 5.1.9 contains a missing authentication vulnerability in the hubcmdui routes/config.js that allows unauthenticated attackers to read and overwrite configuration via /api/config. Attackers can retrieve the WeChat webhook URL and Telegram bot token, and overwrite menuItems links, proxyDomain, and the monitoring webhook destination receiving alerts.
This page as .md · .json · in your agent: get_signal("CVE-2026-116070")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.