CVE-2026-57169: Dockhand: Unauthenticated container exec via WebSocket upgrade
Dockhand is a Docker management application. Prior to 1.0.34, the in-browser container terminal endpoint /api/containers/<id>/exec does not enforce authentication on the WebSocket upgrade request. When an unauthenticated attacker has network reach to Dockhand, knows a target container ID, and targets a container with an interactive shell, the attacker can open a raw WebSocket terminal session and execute commands inside a known target container. This allows unauthenticated command execution inside the container, with possible host compromise when the container has sensitive mounts or privileged execution. This issue is fixed in version 1.0.34.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Dockhandto a version that resolves this vulnerability.Fixed in 1.0.34
Event History
Frequently Asked Questions
Which deployments are practically exposed?
Dockhand deployments prior to 1.0.34 are exposed if an unauthenticated attacker can reach the Dockhand service over the network. Exploitation also requires the attacker to know a target container ID and for that container to have an interactive shell.
Does an attacker need valid Dockhand credentials or user interaction?
No. The WebSocket upgrade request to the container exec endpoint does not enforce authentication, so no credentials or user interaction are required.
What is the likely impact beyond the targeted container?
An attacker can execute commands in the targeted container through a raw WebSocket terminal session. Host compromise may be possible when that container has sensitive mounts or privileged execution.
What should be done if an immediate upgrade is not possible?
Restrict unauthenticated network access to the Dockhand service so untrusted attackers cannot reach it. Limiting exposure does not remove risk for any unauthenticated party that can still access the endpoint.
How can defenders determine whether they are affected?
Check whether Dockhand is running a version earlier than 1.0.34 and whether its container exec endpoint is reachable by unauthenticated network clients. Also identify containers with interactive shells, privileged execution, or sensitive mounts, as these are higher-impact targets.