Dockhand: unauthenticated WebSocket exec gives shell access inside any container whose ID is known

Impact

Dockhand's in-browser container terminal does not enforce authentication on the WebSocket upgrade for /api/containers/<id>/exec. Anyone who can reach the Dockhand service and knows a container ID can open a raw terminal session and run commands inside that container as whatever user its shell runs as. Container IDs are not secrets in any meaningful sense - they leak through logs, labels, compose files and other API surfaces. Where Dockhand manages hosts that run privileged containers or containers with sensitive bind mounts, including the GPU-device and driver mounts typical of accelerator workloads, this becomes host compromise on a node that cannot be drained for free. The management UI is normally the most-trusted thing pointed at a container host, so an auth bypass here is equivalent to handing over the Docker socket.

Who can reach it

Any party with network reach to the Dockhand service - adjacent network per the vendor's own vector - with no credentials. The attacker needs a target container ID and a container that has an interactive shell.

What to do

Upgrade to Dockhand 1.0.34, which enforces authentication on the WebSocket upgrade, and restart the service; it is a single management daemon, so no node drain is involved. Until then, remove network exposure of the Dockhand port - bind it to localhost or put it behind an authenticating reverse proxy - and treat any container it managed while exposed as suspect.

References

Related entries

• RHACM GitOpsCluster: tenant can redirect spoke cluster bearer tokens into a namespace they controlCVE-2026-70398 · Red Hat Advanced Cluster Management - multicloud-integrations (GitOpsCluster controller)Critical
• Dokploy: unquoted dockerImage field gives command execution on the build hostCVE-2026-72877 · Dokploy Docker build path (dockerImage field in buildRemoteDocker)Critical
• OpenChoreo cluster-gateway: unauthenticated management API exposes data-plane Kubernetes API and pod execCVE-2026-73843 · OpenChoreo cluster-gateway (agent listener management API)Critical
• Rancher: SAML assertion replay: the ACS handler does not enforce one-time use, so a captured assertion logsCVE-2026-44946 · RancherCritical
• Coolify: low-privileged member injects Docker Compose directives and gets root on the hostCVE-2025-59156 · Coolify (application deployment workflow, Docker Compose directives)Critical
• Kyverno: percent-encoded traversal in Policy apiCall urlPath escapes the namespace clamp to cluster adminCVE-2026-100706 · Kyverno admission controller (Policy apiCall urlPath namespace clamp)Critical