CVE-2026-126319: Dockhand before 1.0.55 Arbitrary File Read via Stack Adoption Compose Path
Dockhand before 1.0.55 contains an arbitrary file read vulnerability that allows authenticated users with stacks:create permission to read sensitive files by supplying an arbitrary composePath during stack adoption. Attackers can adopt a stack pointing to the encryption key, SQLite database, or /proc/self/environ and read it via the compose endpoint to obtain all stored credentials.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated Dockhand user with the stacks:create permission can exploit it. No user interaction is required.
What access does an attacker gain through successful exploitation?
The attacker can read arbitrary files through the compose endpoint by adopting a stack with a chosen composePath. Sensitive targets include the encryption key, the SQLite database, and /proc/self/environ; obtaining these can expose all stored credentials.
Which versions are affected?
Dockhand versions before 1.0.55 are affected.