DOCKHAND · CVE-2026-126321 · Other
NO FIX YET · SEE WHAT TO DO
Dockhand before 1.0.55 lets a user with stacks:edit permission bypass its file-browser path check using symlinks and '..' sequences. An attacker can read /proc/self/environ, the SQLite database and the encryption key, exposing stored credentials.
first public Oct 26, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams that run Dockhand and give users the stacks:edit permission. The flaw needs a valid account with that permission; instances where only admins have access are less exposed but still should be upgraded. unknown whether the sources describe default configurations.
Not affected if version-1.0.55-or-later
Who cares docker, dockhand, self-hosted
1.0.551.0.55 or laterDockhand before 1.0.55 contains a path traversal vulnerability that allows authenticated users with stacks:edit to bypass the file-browser path guard by combining symlinks with '..' sequences. Attackers can read /proc/self/environ, the SQLite database, and the encryption key via /api/system/files/content, or move them using the stack relocate endpoint, exposing stored credentials.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.