# CVE-2026-57169: Dockhand authentication bypass in container terminal endpoint

Source: https://junglewise.ai/threats/cve-2026-57169-dockhand-is-a-docker-management-application-prior-to-1-0-34-the  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-16. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-57169 · Severity: critical · CVSS 9.6 · Published 2026-10-16

Dockhand is a Docker management application that provides a web interface for managing containers. Prior to version 1.0.34, an attacker on the network can access the in-browser terminal without authentication, execute arbitrary commands inside any container with an interactive shell, and potentially compromise the host if the container has sensitive mounts or elevated privileges.

Technologies: [Finsys Dockhand](https://junglewise.ai/threats/technologies/dockhand). Vendors: [Finsys](https://junglewise.ai/threats/vendors/finsys).

## Quick answers

**Is CVE-2026-57169 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-57169 being exploited in the wild.

**How severe is CVE-2026-57169?** Critical severity, with a CVSS score of 9.6, published 16 October 2026.

**Which products and versions are affected?** Finsys Dockhand prior to 1.0.34.

**Is there a fix for CVE-2026-57169?** Yes: fixed in 1.0.34. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-57169 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-57169?** Check whether you run Finsys Dockhand at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 1.0.34

## Technical details

The /api/containers/<id>/exec endpoint's WebSocket upgrade request does not enforce authentication checks. An unauthenticated attacker with network access, knowledge of a target container ID, and targeting an interactive shell container can establish a raw WebSocket session and execute commands. This requires network reachability and container ID disclosure but no user interaction or authentication.

## Affected products

- Finsys Dockhand prior to 1.0.34

## Timeline

- 2026-10-16: disclosed
- 2026-06-17: patched: v1.0.34 released, closes GHSA-f6q3-chhc-4hxm

## References

- [https://github.com/Finsys/dockhand/commit/efb634701c55f80a8c752df8ae08d88f2c16cce9](https://github.com/Finsys/dockhand/commit/efb634701c55f80a8c752df8ae08d88f2c16cce9)
- [https://github.com/Finsys/dockhand/releases/tag/v1.0.34](https://github.com/Finsys/dockhand/releases/tag/v1.0.34)

## Related threats

- [Dockhand Git-stack webhook plaintext secret disclosure](https://junglewise.ai/threats/cve-2026-121449-dockhand-from-1-0-47-before-1-0-54-exposes-plaintext-stack)
- [Dockhand path traversal in environment routes](https://junglewise.ai/threats/cve-2026-121448-dockhand-before-1-0-54-contains-a-path-traversal-vulnerability)
- [Dockhand arbitrary file read via path traversal](https://junglewise.ai/threats/cve-2026-113354-dockhand-before-1-0-46-contains-an-arbitrary-file-read)
- [Finsys Dockhand response-disclosing SSRF in compose template endpoint](https://junglewise.ai/threats/cve-2026-110255-finsys-dockhand-before-1-0-43-contains-a-response-disclosing)
- [Finsys Dockhand SSRF via IPv6 transition address bypass](https://junglewise.ai/threats/cve-2026-110254-finsys-dockhand-before-1-0-45-contains-a-server-side-request)