Dockwatch EUVD-2026-41405

Exploitation requires network reachability to the Dockwatch web interface (CVSS PR:N/UI:N, so no authentication and no user interaction against a reachable instance). The concrete prerequisites are: the request path through loader.php that redirects unauthenticated users without exit(), which lets the attacker seed the session flag; and the composePull action in ajax/compose.php that feeds the composePath POST parameter into shell_exec(). Full host compromise additionally depends on the standard deployment condition of the Docker socket being mounted into the Dockwatch container - without that, impact is limited to the container context. Limiting factors: the instance must be reachable by the attacker (Dockwatch is commonly deployed on internal/self-hosted networks rather than internet-exposed), and the affected version must be at or below 0.6.567.

Signals point to a genuine high priority for anyone running Dockwatch exposed to untrusted networks. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H, score 9.2) describes a network-reachable, low-complexity, unauthenticated flaw with high impact to confidentiality, integrity, and availability, and the Docker-socket exposure makes 'full host compromise' realistic rather than theoretical. The vendor set AT:P (an attack requirement present), reflecting the extra step of seeding the session flag; in practice that step is attacker-controlled and reliable given the EAR bug, so real-world complexity is closer to low - a divergence worth noting. No EPSS score, SSVC decision, or POC availability was provided in the input, and there is no CISA KEV listing, so exploitation activity is unconfirmed - treat this as high-severity-with-clear-path rather than confirmed mass exploitation. The main mitigating factor is deployment footprint: Dockwatch is a niche self-hosted tool typically not internet-exposed, so real exposure depends heavily on how each operator has published it.

An attacker who can reach a Dockwatch instance sends an unauthenticated request that the EAR bug lets continue past the login redirect, seeding the session flag the app expects. They then POST the composePull action with a malicious composePath value that is passed to shell_exec(), executing shell commands in the container and - via the mounted Docker socket - pivoting to full control of the host. No public exploit identified at time of analysis, but the low attack complexity makes reliable exploitation straightforward once the endpoint is reachable.