# CVE-2026-121449: Dockhand Git-stack webhook plaintext secret disclosure

Source: https://junglewise.ai/threats/cve-2026-121449-dockhand-from-1-0-47-before-1-0-54-exposes-plaintext-stack  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-03. Updated: 2026-11-03  
License: CC BY 4.0 with a link back

CVE-2026-121449 · Severity: medium · CVSS 6.5 · Published 2026-11-03

Dockhand is a container orchestration and deployment management tool that integrates with Git repositories to automate deployments. Versions 1.0.47 through 1.0.53 unintentionally expose plaintext secret values—including credentials from 1Password, Vault, and other secret providers—in responses from deploy endpoints and webhooks. An attacker with a webhook secret or deploy permission can retrieve all stored secrets in the HTTP response, and those secrets may be logged in CI systems or stored in Git forge webhook delivery histories.

Technologies: [Finsys Dockhand](https://junglewise.ai/threats/technologies/dockhand). Vendors: [Finsys](https://junglewise.ai/threats/vendors/finsys).

## Quick answers

**Is CVE-2026-121449 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-121449 being exploited in the wild.

**How severe is CVE-2026-121449?** Medium severity, with a CVSS score of 6.5, published 3 November 2026.

**Which products and versions are affected?** Finsys Dockhand 1.0.47 through 1.0.53.

**Is there a fix for CVE-2026-121449?** Yes: fixed in 1.0.54. Until then: Do not print or log webhook reply bodies in deployment scripts or CI pipelines; parse responses to extract only success, skipped, or exitCode fields. Do not configure Git forge push hooks to target Dockhand webhooks, as forges store webhook response bodies in delivery history. Review existing webhook delivery logs in your Git forge and rotate secrets from any stacks whose webhook responses may have been exposed. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-121449 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-121449?** Check whether you run Finsys Dockhand at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 1.0.54

Do not print or log webhook reply bodies in deployment scripts or CI pipelines; parse responses to extract only success, skipped, or exitCode fields. Do not configure Git forge push hooks to target Dockhand webhooks, as forges store webhook response bodies in delivery history. Review existing webhook delivery logs in your Git forge and rotate secrets from any stacks whose webhook responses may have been exposed.

## Technical details

The deployStack() function in Dockhand unconditionally attaches plaintext resolved secret values to result.resolvedSecrets before returning it. Three API endpoints—Git-stack webhook (POST/GET /api/git/stacks/{id}/webhook), manual deploy (POST /api/git/stacks/{id}/deploy), and create-with-deploy (POST /api/git/stacks)—return or stream this result object unfiltered, exposing secrets to any caller with webhook credentials or stacks:start permission. The vulnerability allows attackers to harvest secrets that should remain server-side; secrets may be persisted in Git forge webhook logs or CI job output.

## Affected products

- Finsys Dockhand 1.0.47 through 1.0.53

## Timeline

- 2026-10-19: disclosed
- 2026-10-19: patched: Version 1.0.54 released
- 2026-11-03: advisory

## References

- [https://github.com/Finsys/dockhand/commit/a08843a8d5ab1d91fa2c6c392919f9117d582471](https://github.com/Finsys/dockhand/commit/a08843a8d5ab1d91fa2c6c392919f9117d582471)
- [https://github.com/Finsys/dockhand/security/advisories/GHSA-w9qx-qg64-f8pf](https://github.com/Finsys/dockhand/security/advisories/GHSA-w9qx-qg64-f8pf)

## Related threats

- [Dockhand path traversal in environment routes](https://junglewise.ai/threats/cve-2026-121448-dockhand-before-1-0-54-contains-a-path-traversal-vulnerability)
- [Dockhand arbitrary file read via path traversal](https://junglewise.ai/threats/cve-2026-113354-dockhand-before-1-0-46-contains-an-arbitrary-file-read)
- [Dockhand authentication bypass in container terminal endpoint](https://junglewise.ai/threats/cve-2026-57169-dockhand-is-a-docker-management-application-prior-to-1-0-34-the)
- [Finsys Dockhand response-disclosing SSRF in compose template endpoint](https://junglewise.ai/threats/cve-2026-110255-finsys-dockhand-before-1-0-43-contains-a-response-disclosing)
- [Finsys Dockhand SSRF via IPv6 transition address bypass](https://junglewise.ai/threats/cve-2026-110254-finsys-dockhand-before-1-0-45-contains-a-server-side-request)