Dockhand: Authentication bypass in static-asset check enables account takeover
Summary
Dockhand before version 1.0.45 skips authentication for any request path ending in a static-asset extension such as .js, including API routes. Because the user management API also lacks permission checks for unauthenticated callers, a remote attacker can reset the password of the admin or any other local user with one PUT request and take over the account. The issue applies to instances with authentication enabled and at least one local user.
Affected
- Dockhand before 1.0.45 (CNA record: affected 0 to below 1.0.45)
- Lower bound of the affected range: Unknown.
Fixed in
- Upgrade to Dockhand 1.0.45 or later.
Workaround
Unknown. The vendor documents no workaround. Upgrading to 1.0.45 or later is the only verified remediation.
Exploitation
- Proof-of-concept details are included in the vendor advisory.
- CISA SSVC assessment: exploitation poc, automatable yes, technical impact total.
- An unverified user report describes a suspected host compromise. It is not confirmed that this vulnerability caused it.
- CISA KEV status: Unknown.
Our recommendation
- Inventory all Dockhand instances, including test and home-lab systems.
- Upgrade to version 1.0.45 or later immediately.
- Remove direct internet exposure and place Dockhand behind a VPN or SSO layer.
- If an instance was exposed while running an older version, review admin accounts, recently created containers and Docker host activity, and rotate stored credentials and secrets.
- Monitor logs for unexpected PUT or DELETE requests to /api/users routes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-r3mg-r5vm-3v6w github.com
- VulnCheck advisory www.vulncheck.com
- OSV entry CVE-2026-110130 osv.dev
- NVD mirror on vulners.com vulners.com
- GitHub issue #1822 (unverified user report) github.com
- threatint CVE mirror cve.threatint.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 14:23.
Original description (NVD)
Dockhand before 1.0.45 contains an authentication bypass in which the global auth hook skips authentication for any path ending in a static-asset extension such as .js, including /api/* routes, and the user-mutation handlers fail open for unauthenticated callers. Unauthenticated remote attackers can send a PUT request to /api/users/<id>.js to reset the admin's or any user's password and take over the account.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.