CVE-2026-126319

MediumCVSS 6.5/10Last modified Nov 13, 2026

Description

Dockhand before 1.0.55 contains an arbitrary file read vulnerability that allows authenticated users with stacks:create permission to read sensitive files by supplying an arbitrary composePath during stack adoption. Attackers can adopt a stack pointing to the encryption key, SQLite database, or /proc/self/environ and read it via the compose endpoint to obtain all stored credentials.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Nov 13, 2026
Last modified: Nov 13, 2026
NVD status: Received

Related CVEs from 2026

CVE-2026-126326.5Zephyr's Precision Time Protocol receive handler ptp_msg_post_recv() in subsys/net/lib/ptp/msg.c takes the 4-bit message type straight off t CVE-2026-1263206.5Dockhand before 1.0.55 contains an improper authorization vulnerability that lets users holding only containers:view download arbitrary cont CVE-2026-1263218.3Dockhand before 1.0.55 contains a path traversal vulnerability that allows authenticated users with stacks:edit to bypass the file-browser p CVE-2026-1263228.1OpenEMR before 8.3.0 contains an unsanitized deserialization vulnerability that allows authenticated attackers to control patient-matching c CVE-2026-1263234.3Vvveb through 1.0.8.6 contains a cross-site request forgery vulnerability that allows attackers to perform admin state-changing actions beca CVE-2026-1263259.0A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited CVE-2026-126326Improper access control in the administrative role assignment endpoint in Devolutions Server 2026.3.13.0 and earlier allows an authenticated CVE-2026-126327Improper access control in the connection history in Devolutions Server 2026.3.13.0 allows an authenticated user without the permission to v CVE-2026-126328Insertion of sensitive information into sent data in the user endpoints in Devolutions Server 2026.3.13.0 and earlier allows an authenticate CVE-2026-1263297.3Docker Sandboxes reuses existing state and configuration directories without verifying their ownership. If sbx or sandboxd is run as root wi CVE-2026-126338.1The IPv6 neighbor-discovery code in subsys/net/ip/ipv6_nbr.c processes the 6LoWPAN Context Option (6CO, RFC 6775) carried inside ICMPv6 Rout CVE-2026-1263302.4Docker Sandboxes can silently republish a sandbox service after an operator removes its automatically assigned host-port mapping. The daemon