{"schema":"threatline.record/2","record":{"id":"CVE-2026-116070","aliases":[],"summary":"Docker-Proxy through 5.1.9 Missing Authentication via hubcmdui /api/config","details":"Docker-Proxy through 5.1.9 contains a missing authentication vulnerability in the hubcmdui routes/config.js that allows unauthenticated attackers to read and overwrite configuration via /api/config. Attackers can retrieve the WeChat webhook URL and Telegram bot token, and overwrite menuItems links, proxyDomain, and the monitoring webhook destination receiving alerts.","categories":["Containers & cloud"],"product":"Docker-Proxy","vendor":"dqzboy","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-116070","source_modified_at":"2026-10-25T11:50:58.565Z","fetched_at":"2026-10-25T16:01:37.004770Z","product":"Docker-Proxy","vendor":"dqzboy","versions":[{"version":"0","status":"affected","versionType":"semver","lessThanOrEqual":"5.1.9"}],"defaultStatus":"unaffected"}],"fixed_versions":[],"cvss":6.9,"severity":"Medium","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-25T11:50:58.565Z","modified_at":"2026-10-25T11:50:58.565Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-116070","fetched_at":"2026-10-25T16:01:37.004770Z","source_modified_at":"2026-10-25T11:50:58.565Z"}],"sources":["CVE List"],"references":[{"source":"CVE List","url":"https://github.com/dqzboy/Docker-Proxy/issues/109","tags":["issue-tracking"]},{"source":"CVE List","url":"https://github.com/dqzboy/Docker-Proxy","tags":["product"]},{"source":"CVE List","url":"https://github.com/dqzboy/Docker-Proxy/blob/4fa5a4baaeb73a9a4e317b6c7fc5db7283380136/hubcmdui/routes/config.js#L22-L103","tags":["technical-description"]},{"source":"CVE List","url":"https://github.com/dqzboy/Docker-Proxy/commit/a173befc5d163b1206b40298871153026fee9474","tags":["patch"]},{"source":"CVE List","url":"https://www.vulncheck.com/advisories/docker-proxy-through-5.1.9-missing-authentication-via-hubcmdui-api-config","tags":["third-party-advisory"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-25T11:50:58.565Z","content_hash":"686d3ddeafb40e5b49b93530fc2c71a43f621f184b66bdc64488281c5bffc130"}}