Docker Proxy
Monthly
Unauthenticated configuration read and write in the hubcmdui web management interface of Docker-Proxy through 5.1.9 lets remote attackers call /api/config to retrieve stored WeChat webhook URLs and Telegram bot tokens and to overwrite menu item links, proxyDomain, and the monitoring webhook that receives alerts. The route lacked any authentication middleware in default deployments (CVSS 4.0 base 6.9, PR:N), so the only real prerequisite is that the hubcmdui interface is network-reachable; the credential theft is further gated by whether notification integrations were actually configured, while the config-overwrite works regardless. The vendor has published a fix (commit a173befc, stated as available), no public exploit code was identified at time of analysis, and the vuln.today priority label is 'this_month', consistent with a genuine but moderate-priority issue rather than a drop-everything emergency. Rotate any WeChat/Telegram credentials that were stored in the exposed configuration.
Unauthenticated configuration read and write in the hubcmdui web management interface of Docker-Proxy through 5.1.9 lets remote attackers call /api/config to retrieve stored WeChat webhook URLs and Telegram bot tokens and to overwrite menu item links, proxyDomain, and the monitoring webhook that receives alerts. The route lacked any authentication middleware in default deployments (CVSS 4.0 base 6.9, PR:N), so the only real prerequisite is that the hubcmdui interface is network-reachable; the credential theft is further gated by whether notification integrations were actually configured, while the config-overwrite works regardless. The vendor has published a fix (commit a173befc, stated as available), no public exploit code was identified at time of analysis, and the vuln.today priority label is 'this_month', consistent with a genuine but moderate-priority issue rather than a drop-everything emergency. Rotate any WeChat/Telegram credentials that were stored in the exposed configuration.