CVE-2026-53988
Dockhand < 1.0.40 Unauthenticated Webhook Trigger via Git Webhook Endpoints
Finsys dockhand
CVSS
9.2CriticalExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.45%Chance of exploitation activity in the next 30 days, higher than 38% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 1.0.40dockhandCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Dockhand before 1.0.40 contains an authentication bypass vulnerability in its git webhook endpoints that allows unauthenticated remote attackers to trigger arbitrary stack redeployments by exploiting a null webhook secret guard condition. Attackers can enumerate sequential stack IDs and send unsigned webhook requests to force git clone and docker compose operations, enabling denial of service or, when combined with write access to the tracked git branch, container escape and full host compromise via attacker-controlled docker-compose.yml with privileged bind mounts.
Text from CVE List
Affected versions 1
- dockhandaffected: all versions before 1.0.40CVE List