CVE-2026-126320: Dockhand before 1.0.55 Improper Authorization via Container File Download Endpoint
Dockhand before 1.0.55 contains an improper authorization vulnerability that lets users holding only containers:view download arbitrary container files instead of requiring containers:exec. Authenticated Enterprise RBAC users can request any path from the files/download endpoint, which reads through Docker's archive API, to retrieve secrets, keys, and mounted credentials.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated Enterprise RBAC user with the containers:view permission can exploit it. The issue does not require containers:exec permission.
What access does exploitation provide?
The affected files/download endpoint can be used to request arbitrary paths from a container through Docker's archive API. This may expose secrets, keys, and mounted credentials stored in or available to the container.
Which deployments are affected?
Dockhand versions before 1.0.55 are affected where Enterprise RBAC users are granted containers:view access. The provided information does not state whether a default role assignment includes that permission.
How can I determine whether exposure has occurred?
Review requests to the files/download endpoint made by users who had containers:view but not containers:exec permissions, particularly requests for sensitive container paths. The provided information does not identify specific paths or logging fields.