---
id: "CVE-2026-126319"
page: "https://infrastack.ai/live/CVE-2026-126319"
kind: "vulnerability"
aliases: ["CVE-2026-126319"]
title: "Dockhand: authenticated users can read arbitrary server files"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["docker", "dockhand", "other", "self-hosted"]
not_affected_if: ["dockhand-1.0.55-or-later", "no-stacks-create-users"]
published_at: "2026-11-13T10:17:38+00:00"
first_seen_at: "2026-11-13T10:47:16+00:00"
updated_at: "2026-11-13T10:53:15+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126319", "first_seen_at": "2026-11-13T10:47:16+00:00"}]
exploit_sources: []
---

# Dockhand: authenticated users can read arbitrary server files

Link for people: https://infrastack.ai/live/CVE-2026-126319 (this .md is for agents)

Dockhand before 1.0.55 lets a user with stack-creation permission point a stack adoption at any file path, then read that file through the compose endpoint. An attacker can use this to read the encryption key, the SQLite database, or process environment variables and obtain stored credentials.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Dockhand version against `1.0.55`; anything older is in the stated range.
- Review which accounts hold the `stacks:create` permission.

## Fix

- Dockhand: move to `1.0.55` or later.

## Timeline

- 2026-11-13T10:47:16+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126319

## Documents

- [advisory] Vendor advisory: github.com https://github.com/Finsys/dockhand/security/advisories/GHSA-q8p8-fhph-f9mj
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/dockhand-before-1.0.55-arbitrary-file-read-via-stack-adoption-compose-path

## From the sources

Dockhand before 1.0.55 contains an arbitrary file read vulnerability that allows authenticated users with stacks:create permission to read sensitive files by supplying an arbitrary composePath during stack adoption. Attackers can adopt a stack pointing to the encryption key, SQLite database, or /proc/self/environ and read it via the compose endpoint to obtain all stored credentials.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_