Dockhand 1.0.34 Patches Unauthenticated RCE in Container Terminal Endpoint

The Dockhand Docker management application contains a critical authentication bypass in its in-browser container terminal endpoint. This flaw permits unauthenticated remote code execution, exposing environments where the application is reachable from the network. Security teams managing container infrastructure should assess their exposure to this specific vector immediately.

Root cause

The vulnerability stems from the /api/containers/<id>/exec endpoint failing to enforce authentication on WebSocket upgrade requests. According to the NVD record, this misconfiguration allows attackers to bypass standard access controls. The issue is classified under CWE-306 and CWE-862, highlighting weaknesses in session management and authentication mechanisms for critical components.

Attack path

An unauthenticated attacker with network reach to the Dockhand instance can exploit this flaw. They must know a target container ID and target a container running an interactive shell. Once connected, the attacker opens a raw WebSocket terminal session. This grants direct command execution inside the container, potentially escalating to host compromise if the container has sensitive mounts or privileged execution rights.

Affected versions

• Finsys Dockhand versions earlier than 1.0.34 are vulnerable.
• The issue is resolved in version 1.0.34.
• No other versions are confirmed affected in the source material.

Mitigation

• Upgrade Dockhand to version 1.0.34 or later.
• Restrict network access to the Dockhand management interface.
• Audit container configurations for privileged execution or sensitive mounts.
• Monitor for unauthorized WebSocket connections to terminal endpoints.

Signals worth monitoring

Teams usually detect this activity by reviewing WebSocket connection logs for unauthenticated upgrade requests to the exec endpoint. Check whether terminal sessions originate from unexpected IP addresses or lack valid session tokens. Look for anomalous command execution patterns within containers, especially from users who should not have access. Isolate affected containers immediately and review audit logs for lateral movement indicators.

What to do and how to stay safe: Dockhand

• Verify your Dockhand version and upgrade if it is below 1.0.34.
• Restrict network access to the management interface using firewalls or security groups.
• Monitor logs for unauthorized WebSocket connections to terminal endpoints.
• Review container permissions to ensure no unnecessary privileged execution is enabled.

Step-by-step guide: Out-of-band patches: what small businesses need to know

General security guidance from the Firewall Pulse newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-57169?

It is a critical authentication bypass in Dockhand’s container terminal endpoint allowing unauthenticated command execution.

Which versions are affected?

All versions of Finsys Dockhand prior to 1.0.34 are vulnerable.

Is there a fix?

Yes, the issue is fixed in version 1.0.34.