{"id":"CVE-2026-126321","kind":"vulnerability","aliases":["CVE-2026-126321"],"related":[],"title":"Dockhand: path traversal lets authenticated users read stored credentials","description":"Dockhand before 1.0.55 contains a path traversal vulnerability that allows authenticated users with stacks:edit to bypass the file-browser path guard by combining symlinks with '..' sequences. Attackers can read /proc/self/environ, the SQLite database, and the encryption key via /api/system/files/content, or move them using the stack relocate endpoint, exposing stored credentials.","summary":"Dockhand before 1.0.55 lets a user with stacks:edit permission bypass its file-browser path check using symlinks and '..' sequences. An attacker can read /proc/self/environ, the SQLite database and the encryption key, exposing stored credentials.","severity":"high","cvss":8.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Dockhand","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["docker","dockhand","other","self-hosted"],"not_affected_if":["version-1.0.55-or-later"],"how_to_check":"- Check the installed Dockhand version and compare it with `1.0.55`\n- Look for the Dockhand container image tag or release in your deployment config","fix":"- Dockhand: upgrade to `1.0.55` or later","status":"open","published_at":"2026-11-13T10:17:38+00:00","first_seen_at":"2026-11-13T10:47:16+00:00","triaged_at":"2026-11-13T10:51:11+00:00","updated_at":"2026-11-13T10:51:11+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-13T10:51:11Z","model":"claude-haiku-5-5","output":{"fix":"- Dockhand: upgrade to `1.0.55` or later","reach":"internet","title":"Dockhand: path traversal lets authenticated users read stored credentials","impact":"high","summary":"Dockhand before 1.0.55 lets a user with stacks:edit permission bypass its file-browser path check using symlinks and '..' sequences. An attacker can read /proc/self/environ, the SQLite database and the encryption key, exposing stored credentials.","audience":"businesses","category":"other","nicknames":[],"who_cares":["dockhand","self-hosted","docker"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"stored credentials and encryption key readable by an authenticated user","analyst_note":"Confirm the affected version range and default configuration from the vendor advisory at github.com and the VulnCheck advisory.","how_to_check":"- Check the installed Dockhand version and compare it with `1.0.55`\n- Look for the Dockhand container image tag or release in your deployment config","plain_action":"","product_name":"Dockhand","needs_analyst":true,"not_affected_if":["version-1.0.55-or-later"],"who_is_affected":"Teams that run Dockhand and give users the stacks:edit permission. The flaw needs a valid account with that permission; instances where only admins have access are less exposed but still should be upgraded. unknown whether the sources describe default configurations.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000733,"input_tokens":4625,"output_tokens":540,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-126321':12A,15A '-2026':11A,14A '/api/system/files/content':99C '/proc/self/environ':48B,90C '1.0.55':25B,61C 'allow':68C 'attack':45B,87C 'authent':5A,69C 'browser':37B,79C 'bypass':33B,75C 'check':39B 'combin':83C 'contain':62C 'credenti':9A,58B,110C 'cve':10A,13A 'databas':51B,93C 'docker':17B 'dockhand':1A,16A,18B,23B,59C 'edit':31B,73C 'encrypt':54B,96C 'endpoint':107C 'expos':56B,108C 'file':36B,78C 'file-brows':35B,77C 'guard':81C 'host':22B 'key':55B,97C 'let':4A,26B 'move':101C 'path':2A,38B,64C,80C 'permiss':32B 'read':7A,47B,89C 'reloc':106C 'self':21B 'self-host':20B 'sequenc':43B,86C 'sqlite':50B,92C 'stack':30B,72C,105C 'store':8A,57B,109C 'symlink':41B,84C 'travers':3A,65C 'use':40B,103C 'user':6A,28B,70C 'via':98C 'vulner':66C","nicknames":[],"mitigations":[],"who_affected":"Teams that run Dockhand and give users the stacks:edit permission. The flaw needs a valid account with that permission; instances where only admins have access are less exposed but still should be upgraded. unknown whether the sources describe default configurations.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["dockhand"],"ptokens":["dockhand"],"labels":["docker","dockhand","high","other","selfhosted","vendor"],"campaign_type":null,"search_a":"'-126321':12A,15A '-2026':11A,14A 'authent':5A 'credenti':9A 'cve':10A,13A 'dockhand':1A,16A 'let':4A 'path':2A 'read':7A 'store':8A 'travers':3A 'user':6A","search_b":"'/proc/self/environ':48B '1.0.55':25B 'attack':45B 'browser':37B 'bypass':33B 'check':39B 'credenti':58B 'databas':51B 'docker':17B 'dockhand':18B,23B 'edit':31B 'encrypt':54B 'expos':56B 'file':36B 'file-brows':35B 'host':22B 'key':55B 'let':26B 'path':38B 'permiss':32B 'read':47B 'self':21B 'self-host':20B 'sequenc':43B 'sqlite':50B 'stack':30B 'store':57B 'symlink':41B 'use':40B 'user':28B","search_c":"'/api/system/files/content':99C '/proc/self/environ':90C '1.0.55':61C 'allow':68C 'attack':87C 'authent':69C 'browser':79C 'bypass':75C 'combin':83C 'contain':62C 'credenti':110C 'databas':93C 'dockhand':59C 'edit':73C 'encrypt':96C 'endpoint':107C 'expos':108C 'file':78C 'file-brows':77C 'guard':81C 'key':97C 'move':101C 'path':64C,80C 'read':89C 'reloc':106C 'sequenc':86C 'sqlite':92C 'stack':72C,105C 'store':109C 'symlink':84C 'travers':65C 'use':103C 'user':70C 'via':98C 'vulner':66C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-26T12:14:56+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126321","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126321","severity":null,"published_at":"2026-11-13T10:17:38+00:00","modified_at":"2026-11-13T10:17:38+00:00","first_seen_at":"2026-11-13T10:47:16+00:00","fetched_at":"2026-11-13T10:47:16+00:00","note":null}],"documents":[{"id":144973,"url":"https://github.com/Finsys/dockhand/security/advisories/GHSA-8vcv-cvj7-g5vx","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-26T12:14:56+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":144974,"url":"https://www.vulncheck.com/advisories/dockhand-before-1.0.55-path-traversal-via-symlink-in-file-browser-endpoints","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}