Dockhand
Monthly
Unauthenticated remote command execution inside containers managed by Dockhand (Finsys) affects all versions prior to 1.0.34: the WebSocket upgrade request for the in-browser terminal endpoint /api/containers/<id>/exec is served without any authentication check, so an attacker who can reach the instance and knows a running container ID can open a raw terminal session and run commands inside that container. No authentication is required (CVSS:3.1/PR:N, CWE-306), and the S:C/C:H/I:H/A:H scoring reflects realistic container-to-host escalation when the target container is privileged or exposes sensitive host mounts such as the Docker socket; exploitation is constrained in practice because the attacker must know or enumerate a specific container ID and the target must have an interactive shell. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, though the pre-auth nature and high EPSS-relevant profile make the issue high priority; a vendor-released patch exists in version 1.0.34.
Open redirect in the OIDC initiation endpoint of Dockhand before 1.0.36 allows unauthenticated remote attackers to bounce authenticated users to attacker-controlled sites through an unvalidated redirect query parameter. Because the redirect is chained into the real OIDC callback flow, an authorization code can leak to the attacker via the Referer header of the victim's browser, enabling follow-up credential phishing against any Dockhand account after a legitimate login. No public exploit code has been identified at time of analysis, and exploitation is conditional on OIDC/SSO being the configured authentication mechanism, a valid version below 1.0.36, and successful user interaction (CVSS 3.1 assessment: 5.3, scope-changed, confidentiality-only).
Unauthenticated remote command execution inside containers managed by Dockhand (Finsys) affects all versions prior to 1.0.34: the WebSocket upgrade request for the in-browser terminal endpoint /api/containers/<id>/exec is served without any authentication check, so an attacker who can reach the instance and knows a running container ID can open a raw terminal session and run commands inside that container. No authentication is required (CVSS:3.1/PR:N, CWE-306), and the S:C/C:H/I:H/A:H scoring reflects realistic container-to-host escalation when the target container is privileged or exposes sensitive host mounts such as the Docker socket; exploitation is constrained in practice because the attacker must know or enumerate a specific container ID and the target must have an interactive shell. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, though the pre-auth nature and high EPSS-relevant profile make the issue high priority; a vendor-released patch exists in version 1.0.34.
Open redirect in the OIDC initiation endpoint of Dockhand before 1.0.36 allows unauthenticated remote attackers to bounce authenticated users to attacker-controlled sites through an unvalidated redirect query parameter. Because the redirect is chained into the real OIDC callback flow, an authorization code can leak to the attacker via the Referer header of the victim's browser, enabling follow-up credential phishing against any Dockhand account after a legitimate login. No public exploit code has been identified at time of analysis, and exploitation is conditional on OIDC/SSO being the configured authentication mechanism, a valid version below 1.0.36, and successful user interaction (CVSS 3.1 assessment: 5.3, scope-changed, confidentiality-only).