Live › vulnerability › CVE-2026-121449
Dockhand versions 1.0.47 before 1.0.54 attach resolved secret values to the result of deployStack(), and Git-stack routes return that result unfiltered. Holders of a stack's webhook secret or users with stacks:start permission can receive stored and external-provider secrets such as 1Password or Vault values.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 15:22 UTC. All times on this page are UTC.
Teams running Dockhand from 1.0.47 up to but not including 1.0.54 that deploy Git-based stacks with secrets. Exposure comes from the deploy and webhook responses, so users with stacks:start permission or holders of a stack's webhook secret can read the secret values. Installations on 1.0.54 or later, or without stored secrets, are not affected by this report.
No product ranges from the sources yet.
1.0.47 to 1.0.54stacks:start permission or know a stack's webhook secret1.0.54 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Dockhand from 1.0.47 before 1.0.54 exposes plaintext stack secrets because deployStack() attaches resolved secret values to its result as resolvedSecrets, which Git-stack routes return unfiltered. Holders of a stack's webhook secret or users with stacks:start permission can trigger the Git stack webhook, manual deploy, or create-and-deploy endpoints to receive stored and external-provider secrets such as 1Password or Vault values.
This page as .md · .json · in your agent: get_signal("CVE-2026-121449")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.