Executive brief
Dockyard, a Docker container management application, is vulnerable to a security flaw that allows unauthorized control over running services. An attacker can trick a logged-in administrator into unknowingly starting or stopping Docker containers by visiting a malicious website. This could lead to service disruptions or unauthorized access to applications managed by the platform.
Technical details
Dockyard prior to version 1.1.0 is vulnerable to Cross-Site Request Forgery (CSRF) and missing authentication for critical functions. The application performs state-changing operations, specifically starting and stopping Docker containers, using HTTP GET requests via the /apps/action.php endpoint. Because these requests lack CSRF tokens or adequate authentication checks, a remote attacker can craft a malicious link or hidden element that, when loaded by an authenticated administrator, triggers the start or stop action on a specified container. The vulnerability is exploited over the network and requires user interaction from an administrator. The issue is resolved in version 1.1.0.
Affected products
- 10ij Dockyard < 1.1.0
Timeline
- 2026-04-09: disclosed
- 2026-04-09: advisory
- 2026-04-09: patched: Fixed in version 1.1.0