Docker-Proxy CVE-2026-116070

No special conditions on the request itself - remote unauthenticated access to the /api/config endpoint of Docker-Proxy's hubcmdui web management component is sufficient against default configurations through 5.1.9, since the route had no authentication middleware. The practical prerequisite is that the hubcmdui management interface is network-reachable by the attacker (e.g., exposed to the internet or an untrusted network) rather than bound to localhost or placed behind a reverse-proxy auth layer. The value of the disclosed secrets is further gated by configuration: the WeChat webhook URL and Telegram bot token are only exposed if the monitoring/notification features have actually been configured; if no notification integrations are set, there are no such credentials to steal, though the config-overwrite (menuItems links, proxyDomain, webhook destination) remains exploitable regardless.

Signals point to a genuine but moderate-priority issue rather than a drop-everything emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes the easiest possible reachability - remote, unauthenticated, low complexity, no user interaction - which raises exploitability, but the vulnerable-system impact is deliberately scored low (VC:L/VI:L/VA:N) because what is exposed is configuration data and notification credentials rather than full system compromise, yielding a 6.9 (Medium) score. The vuln.today decision label is 'this_month', not 'act_now' or 'emergency', which is consistent with that moderate impact. No CISA KEV listing and no EPSS probability were supplied in the input, so there is no signal of active or imminent mass exploitation; absence of these is not itself evidence of safety, but nothing here indicates widespread exploitation. The references include the vendor repo, the fixing commit, issue #109, and a VulnCheck advisory, but none is presented as confirmed working exploit code. Net: a real, easily-triggered flaw worth patching on a normal cycle, elevated mainly by the trivial unauthenticated reachability and the leak of messaging credentials, but tempered by low technical impact and a niche deployment footprint. Missing EPSS means likelihood of exploitation cannot be quantified from the provided data.

An attacker who can reach an internet-exposed Docker-Proxy hubcmdui management interface sends an unauthenticated GET to /api/config and harvests the stored WeChat webhook URL and Telegram bot token, then sends an unauthenticated POST to /api/config to overwrite menuItems links, proxyDomain, and the monitoring webhook destination. This lets the attacker redirect the landing page's links to attacker-controlled sites and silently divert or suppress monitoring alerts. No public working exploit code is identified in the input, though a fixing commit and issue #109 publicly describe the flaw.