Which versions of Dockwatch are affected by CVE-2026-58455?

Notifiarr Dockwatch through version 0.6.567 contains a critical unauthenticated remote code execution vulnerability allowing attackers to execute arbitrary OS commands on affected systems.

Is there a public PoC exploit available for CVE-2026-58455?

Yes, a public proof-of-concept exploit is available for CVE-2026-58455. Prioritise patching immediately. EPSS: 1.2%.

How to fix or mitigate CVE-2026-58455?

Within 24 hours: identify all instances of Notifiarr Dockwatch and verify current versions. Within 7 days: restrict network access to Dockwatch service; evaluate Docker socket mounting necessity and implement runtime access controls if socket mounting is operationally required. Within 30 days: monitor for vendor patch release and apply immediately upon availability.

Dockwatch CVE-2026-58455

Q: What is the CVSS score of CVE-2026-58455?

CVE-2026-58455 has a CVSS 4.0 base score of 9.2 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 1.2%.

EUVD-2026-41405 CRITICAL

Execution After Redirect (EAR) (CWE-698)

2026-07-02 VulnCheck

GHSA-cgfv-42v7-7f53

PHP Docker Command Injection Dockwatch

9.2

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.2 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Unauthenticated network-reachable command injection with a reliable, attacker-controlled auth bypass gives AC:L/PR:N/UI:N and full C/I/A impact; scope kept Unchanged to match the vendor's containment view.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 16:31 vuln.today

CVE Published

Jul 02, 2026 - 15:12 cve.org

CRITICAL 9.2

DescriptionCVE.org

Dockwatch through 0.6.567 contains an unauthenticated OS command injection vulnerability that allows remote attackers to execute arbitrary shell commands by exploiting a missing exit() after an authentication redirect in loader.php combined with unsanitized input passed to shell_exec() in ajax/compose.php. Attackers can seed the required session flag through the incomplete auth check, then inject arbitrary commands via the composePath POST parameter in the composePull action to achieve full host compromise, facilitated by the standard deployment mounting of the Docker socket.

Articles & Coverage 1

News Critical OS Command Injection in Notifiarr Dockwatch - CVE-2026-58455 Jul 03, 2026

AnalysisAI

Unauthenticated OS command injection in Notifiarr Dockwatch through version 0.6.567 lets remote attackers run arbitrary shell commands on the host and achieve full compromise, since default deployments mount the Docker socket. The root cause is an Execution-After-Redirect flaw (CWE-698) where loader.php redirects unauthenticated users but fails to call exit(), allowing the attacker to seed the required session flag and then reach shell_exec() in ajax/compose.php with attacker-controlled input. The CVSS 4.0 base score is 9.2 (VC/VI/VA all High); there is no public exploit identified at time of analysis and it is not listed in CISA KEV, though a vendor advisory and upstream fix exist.

Technical ContextAI

Dockwatch is a PHP web application (tagged PHP, Docker) from Notifiarr that manages and monitors Docker containers, identified in the affected CPE as cpe:2.3:a:notifiarr:dockwatch. The vulnerability class is CWE-698, Execution After Redirect (EAR): loader.php issues an HTTP redirect for unauthenticated requests but does not terminate script execution with exit()/die(), so PHP keeps processing the request and evaluates authenticated-only logic anyway. This lets an attacker set the session flag that the incomplete auth check relies on, after which the composePull action in ajax/compose.php passes the composePath POST parameter into shell_exec() without sanitization, yielding OS command execution. Because standard Dockwatch deployments bind-mount the host Docker socket into the container for their management features, code execution in the app translates directly into control over the Docker daemon and therefore the underlying host.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - apply the code fix from https://github.com/Notifiarr/dockwatch/pull/135, which adds the missing exit() after the authentication redirect and addresses the unsanitized shell_exec() input, and upgrade to the first Notifiarr Dockwatch release that incorporates PR #135 (verify the exact tagged version against the project's release notes, as the input data does not confirm a specific fixed version number). Until patched, remove Dockwatch from any untrusted or internet-facing network and place it behind authenticated reverse-proxy access or a VPN so the composePull endpoint in ajax/compose.php cannot be reached anonymously, and restrict source IPs to trusted admin hosts. Where feasible, reduce blast radius by not bind-mounting the host Docker socket directly (use a least-privilege docker-socket-proxy that limits API scope), accepting that this may break some container-management features. Consult the VulnCheck advisory at https://www.vulncheck.com/advisories/dockwatch-unauthenticated-os-command-injection-via-ajax-compose-php for authoritative guidance.