CVE-2026-126320 · Infrastructure
NO FIX YET · SEE WHAT TO DO
Dockhand before 1.0.55 lets users who only hold the containers:view permission download arbitrary files from containers, when they should need containers:exec. An attacker with such an account can retrieve secrets, keys and mounted credentials.
first public Oct 26, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams running Dockhand with Enterprise RBAC enabled, where some users hold only containers:view. Installations without Enterprise RBAC, or where no user has that limited role, are not described as exposed. The flaw is reached through the files/download endpoint, which reads container files via Docker's archive API.
Not affected if no-view-only-users, rbac-disabled
Who cares docker, dockhand, enterprise-rbac, self-hosted
1.0.55 or later (per the advisory's 'before 1.0.55' range)Dockhand before 1.0.55 contains an improper authorization vulnerability that lets users holding only containers:view download arbitrary container files instead of requiring containers:exec. Authenticated Enterprise RBAC users can request any path from the files/download endpoint, which reads through Docker's archive API, to retrieve secrets, keys, and mounted credentials.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.