CVE-2026-116070
Docker-Proxy through 5.1.9 Missing Authentication via hubcmdui /api/config
dqzboy Docker-ProxyContainers & cloud
CVSS
6.9MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
What fixes it
No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.
Description
Docker-Proxy through 5.1.9 contains a missing authentication vulnerability in the hubcmdui routes/config.js that allows unauthenticated attackers to read and overwrite configuration via /api/config. Attackers can retrieve the WeChat webhook URL and Telegram bot token, and overwrite menuItems links, proxyDomain, and the monitoring webhook destination receiving alerts.
Text from CVE List
Affected versions 1
- Docker-Proxyaffected: all versions through 5.1.9CVE List
References 5
- github.com/dqzboy/Docker-Proxy/commit/a173befc5d163b1206b40298871153026fee9474Fixvia CVE List
- vulncheck.com/advisories/docker-proxy-through-5.1.9-missing-authentication-via-hubcmdui-api-configAdvisoryvia CVE List
- github.com/dqzboy/Docker-Proxy/issues/109Referencevia CVE List
- github.com/dqzboy/Docker-ProxyReferencevia CVE List
- github.com/dqzboy/Docker-Proxy/blob/4fa5a4baaeb73a9a4e317b6c7fc5db7283380136/hubcmdui/routes/config.js#L22-L103Referencevia CVE List