Dockhand CVE-2026-110130

No special conditions beyond network reachability of the Dockhand HTTP API: exploitation works against default configurations of any Dockhand instance before 1.0.45. The specific trigger is any request whose path ends in a static-asset extension (e.g. .js), which causes the global authentication hook to skip the auth check even for /api/* routes; combined with user-mutation handlers that fail open for unauthenticated callers, a PUT to /api/users/<id>.js resets an arbitrary user's (including admin's) password. The only genuine limiting factor is network exposure - an instance whose API is not reachable by the attacker (internal-only, firewalled, or behind an authenticating reverse proxy) is not exploitable; no authentication, user interaction, or non-default setting is required.

Every available signal points to maximum, real-world risk. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes network-reachable, low-complexity exploitation requiring no privileges and no user interaction, and this is fully consistent with the description: an unauthenticated PUT to /api/users/<id>.js resets any account's password. The CWE-288 (authentication bypass via alternate path) classification matches the described flaw exactly - the global auth hook treats any path ending in a static-asset extension as public, and the user-mutation handlers fail open. This is a priority issue, not a high-CVSS-but-low-risk paper cut: it yields direct admin account takeover with a single request. Tempering the urgency, no EPSS score, no KEV listing, and no POC flag were provided in the input, so there is no evidence of active exploitation or published exploit code at this time; the 10.0 reflects intrinsic severity, not demonstrated mass exploitation. The 4.0 subsequent-system impacts (SC:H/SI:H/SA:H) are plausible given that a compromised Dockhand admin typically controls Docker hosts/containers behind it, but the input does not confirm that downstream reach - treat it as vendor-scored rather than independently verified.

An attacker who can reach the Dockhand web interface sends a single crafted PUT request to /api/users/<id>.js; because the path ends in .js the global auth hook skips authentication, and the fail-open user-mutation handler resets the targeted account's password. The attacker then logs in as the admin and takes full control of the Dockhand instance. No public exploit code was identified in the provided data, but the technique is trivially reproducible from the description.