{"id":"CVE-2026-126319","kind":"vulnerability","aliases":["CVE-2026-126319"],"related":[],"title":"Dockhand: authenticated users can read arbitrary server files","description":"Dockhand before 1.0.55 contains an arbitrary file read vulnerability that allows authenticated users with stacks:create permission to read sensitive files by supplying an arbitrary composePath during stack adoption. Attackers can adopt a stack pointing to the encryption key, SQLite database, or /proc/self/environ and read it via the compose endpoint to obtain all stored credentials.","summary":"Dockhand before 1.0.55 lets a user with stack-creation permission point a stack adoption at any file path, then read that file through the compose endpoint. An attacker can use this to read the encryption key, the SQLite database, or process environment variables and obtain stored credentials.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["docker","dockhand","other","self-hosted"],"not_affected_if":["dockhand-1.0.55-or-later","no-stacks-create-users"],"how_to_check":"- Check the installed Dockhand version against `1.0.55`; anything older is in the stated range.\n- Review which accounts hold the `stacks:create` permission.","fix":"- Dockhand: move to `1.0.55` or later.","status":"open","published_at":"2026-11-13T10:17:38+00:00","first_seen_at":"2026-11-13T10:47:16+00:00","triaged_at":"2026-11-13T10:53:15+00:00","updated_at":"2026-11-13T10:53:15+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-11-13T10:53:15Z","model":"claude-haiku-5-5","output":{"fix":"- Dockhand: move to `1.0.55` or later.","reach":"network","title":"Dockhand: authenticated users can read arbitrary server files","impact":"high","summary":"Dockhand before 1.0.55 lets a user with stack-creation permission point a stack adoption at any file path, then read that file through the compose endpoint. An attacker can use this to read the encryption key, the SQLite database, or process environment variables and obtain stored credentials.","audience":"businesses","category":"other","nicknames":[],"who_cares":["dockhand","self-hosted","docker"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Server secrets and credentials readable by an authenticated low-privilege user","analyst_note":"Product-level exposure defaults are not stated in the sources; confirm whether stacks:create is granted by default.","how_to_check":"- Check the installed Dockhand version against `1.0.55`; anything older is in the stated range.\n- Review which accounts hold the `stacks:create` permission.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["dockhand-1.0.55-or-later","no-stacks-create-users"],"who_is_affected":"Teams running self-hosted Dockhand where some users hold the stacks:create permission. The flaw needs an authenticated account with that permission, so instances where only administrators can create stacks are lower exposure but still should be patched. Teams not running Dockhand can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000733,"input_tokens":4621,"output_tokens":542,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-126319':11A,14A '-2026':10A,13A '/proc/self/environ':111C '1.0.55':23B,71C 'adopt':35B,97C,100C 'allow':79C 'arbitrari':6A,74C,93C 'attack':49B,98C 'authent':2A,80C 'compos':46B,117C 'composepath':94C 'contain':72C 'creat':84C 'creation':30B 'credenti':68B,123C 'cve':9A,12A 'databas':60B,109C 'docker':15B 'dockhand':1A,16B,21B,69C 'encrypt':56B,106C 'endpoint':47B,118C 'environ':63B 'file':8A,38B,43B,75C,89C 'host':20B 'key':57B,107C 'let':24B 'obtain':66B,120C 'path':39B 'permiss':31B,85C 'point':32B,103C 'process':62B 'read':5A,41B,54B,76C,87C,113C 'self':19B 'self-host':18B 'sensit':88C 'server':7A 'sqlite':59B,108C 'stack':29B,34B,83C,96C,102C 'stack-creat':28B 'store':67B,122C 'suppli':91C 'use':51B 'user':3A,26B,81C 'variabl':64B 'via':115C 'vulner':77C","nicknames":[],"mitigations":[],"who_affected":"Teams running self-hosted Dockhand where some users hold the stacks:create permission. The flaw needs an authenticated account with that permission, so instances where only administrators can create stacks are lower exposure but still should be patched. Teams not running Dockhand can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["docker","dockhand","high","other","selfhosted"],"campaign_type":null,"search_a":"'-126319':11A,14A '-2026':10A,13A 'arbitrari':6A 'authent':2A 'cve':9A,12A 'dockhand':1A 'file':8A 'read':5A 'server':7A 'user':3A","search_b":"'1.0.55':23B 'adopt':35B 'attack':49B 'compos':46B 'creation':30B 'credenti':68B 'databas':60B 'docker':15B 'dockhand':16B,21B 'encrypt':56B 'endpoint':47B 'environ':63B 'file':38B,43B 'host':20B 'key':57B 'let':24B 'obtain':66B 'path':39B 'permiss':31B 'point':32B 'process':62B 'read':41B,54B 'self':19B 'self-host':18B 'sqlite':59B 'stack':29B,34B 'stack-creat':28B 'store':67B 'use':51B 'user':26B 'variabl':64B","search_c":"'/proc/self/environ':111C '1.0.55':71C 'adopt':97C,100C 'allow':79C 'arbitrari':74C,93C 'attack':98C 'authent':80C 'compos':117C 'composepath':94C 'contain':72C 'creat':84C 'credenti':123C 'databas':109C 'dockhand':69C 'encrypt':106C 'endpoint':118C 'file':75C,89C 'key':107C 'obtain':120C 'permiss':85C 'point':103C 'read':76C,87C,113C 'sensit':88C 'sqlite':108C 'stack':83C,96C,102C 'store':122C 'suppli':91C 'user':81C 'via':115C 'vulner':77C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-26T12:14:13+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126319","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126319","severity":null,"published_at":"2026-11-13T10:17:38+00:00","modified_at":"2026-11-13T10:17:38+00:00","first_seen_at":"2026-11-13T10:47:16+00:00","fetched_at":"2026-11-13T10:47:16+00:00","note":null}],"documents":[{"id":144969,"url":"https://github.com/Finsys/dockhand/security/advisories/GHSA-q8p8-fhph-f9mj","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-26T12:14:13+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":144970,"url":"https://www.vulncheck.com/advisories/dockhand-before-1.0.55-arbitrary-file-read-via-stack-adoption-compose-path","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}