Dockhand 1.0.34 Fixes Critical Unauthenticated Remote Code Execution Flaw

The vendor Finsys released version 1.0.34 of the Dockhand Docker management application to address a critical security vulnerability. This update fixes a flaw that allowed unauthenticated users to execute arbitrary commands inside targeted containers. The issue has been assigned CVE-2026-57169 and carries a CVSS score of 9.6, which is classified as Critical severity by the National Vulnerability Database.

The vulnerability stems from a lack of authentication enforcement on the in-browser container terminal endpoint. Specifically, the API path /api/containers/<id>/exec failed to require valid credentials when processing WebSocket upgrade requests. According to the NVD record, this weakness is associated with CWE-306 and CWE-862, indicating issues with missing authentication for critical functions and improper handling of authorization.

Context and Background

For an attacker to exploit this flaw, they must have network reach to the Dockhand instance. They also need to know the specific ID of a target container that has an interactive shell available. Once these conditions are met, the attacker can establish a raw WebSocket terminal session. This session provides direct access to the container's command line interface without any form of user verification or login prompt.

The NVD description notes that this allows for unauthenticated command execution inside the container. If the compromised container has sensitive host mounts or runs with privileged execution rights, the attacker could potentially move laterally. This escalation could lead to full compromise of the underlying host system, expanding the blast radius beyond the single container boundary.

Who Is Affected

Any organization using Dockhand versions earlier than 1.0.34 is affected by this vulnerability. The flaw exists in the core management interface that administrators use to interact with Docker containers. Because the endpoint is designed for legitimate administrative use, it is often exposed to networks where administrators operate. This exposure increases the risk if network segmentation is not strictly enforced.

The NVD record confirms that the issue is resolved in version 1.0.34. Users running older versions remain vulnerable until they apply this specific update. The fix ensures that the WebSocket upgrade request now properly enforces authentication, blocking unauthorized access attempts. This change restores the intended security controls for the container terminal functionality.

What should you do?

Administrators should immediately verify their current Dockhand version. If the version is below 1.0.34, they should prioritize upgrading to the latest release. Until the update is applied, organizations should restrict network access to the Dockhand management interface. Limiting exposure to trusted internal networks reduces the likelihood of an attacker reaching the vulnerable endpoint.