CVE-2026-116070: Docker-Proxy through 5.1.9 Missing Authentication via hubcmdui /api/config
Docker-Proxy through 5.1.9 contains a missing authentication vulnerability in the hubcmdui routes/config.js that allows unauthenticated attackers to read and overwrite configuration via /api/config. Attackers can retrieve the WeChat webhook URL and Telegram bot token, and overwrite menuItems links, proxyDomain, and the monitoring webhook destination receiving alerts.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Docker-Proxy versions through 5.1.9 are affected where the hubcmdui /api/config endpoint is reachable by an attacker. The issue requires no authentication, user interaction, or prior privileges.
What can an unauthenticated attacker obtain or change?
An attacker can read configuration data, including the WeChat webhook URL and Telegram bot token. They can also overwrite menuItems links, proxyDomain, and the monitoring webhook destination used for alerts.
How can I check whether my instance has been exposed?
Review access logs for requests to /api/config, particularly unexpected read or update requests. Also inspect the current configuration for unrecognized menu item links, proxyDomain values, or monitoring webhook destinations, and treat exposed WeChat webhook URLs and Telegram bot tokens as compromised.