CVE-2026-126319 · Other
NO FIX YET · SEE WHAT TO DO
Dockhand before 1.0.55 lets a user with stack-creation permission point a stack adoption at any file path, then read that file through the compose endpoint. An attacker can use this to read the encryption key, the SQLite database, or process environment variables and obtain stored credentials.
first public Oct 26, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams running self-hosted Dockhand where some users hold the stacks:create permission. The flaw needs an authenticated account with that permission, so instances where only administrators can create stacks are lower exposure but still should be patched. Teams not running Dockhand can skip it.
Not affected if dockhand-1.0.55-or-later, no-stacks-create-users
Who cares docker, dockhand, self-hosted
1.0.55; anything older is in the stated range.stacks:create permission.1.0.55 or later.Dockhand before 1.0.55 contains an arbitrary file read vulnerability that allows authenticated users with stacks:create permission to read sensitive files by supplying an arbitrary composePath during stack adoption. Attackers can adopt a stack pointing to the encryption key, SQLite database, or /proc/self/environ and read it via the compose endpoint to obtain all stored credentials.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.