CVE-2026-110130: Dockhand before 1.0.45 Authentication Bypass via Static-Asset Check
Dockhand before 1.0.45 contains an authentication bypass in which the global auth hook skips authentication for any path ending in a static-asset extension such as .js, including /api/ routes, and the user-mutation handlers fail open for unauthenticated callers. Unauthenticated remote attackers can send a PUT request to /api/users/<id>.js to reset the admin's or any user's password and take over the account.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Dockhand versions before 1.0.45 are exposed if the affected API routes are reachable by an unauthenticated remote attacker. The issue is in the global authentication hook and applies to API paths that can be made to end in a static-asset extension such as .js.
What does an attacker need to exploit this?
No credentials or user interaction are required. An attacker can send a PUT request to /api/users/<id>.js and reset the password for the administrator or another user, then use the new password to take over that account.
How can I check for attempted or successful exploitation?
Review request logs for unauthenticated PUT requests to /api/users/ paths with a static-asset suffix, particularly .js. Investigate password resets for administrator or user accounts that do not correspond to authorized activity.
What should be done if an immediate upgrade is not possible?
Restrict unauthenticated access to Dockhand API endpoints, especially PUT requests to /api/users/* paths and paths ending in static-asset extensions such as .js. Review user passwords and reset credentials for accounts that may have been changed through unauthorized requests.