CVE-2026-116070

Published: Ott 25, 2026 Last Modified: Ott 25, 2026

ExploitDB:

Other exploit source:

Google Dorks:

MEDIUM 6,9

Source: [email protected]

Attack Vector: network

Attack Complexity: low

Privileges Required: none

User Interaction: none

Confidentiality: N/A

Integrity: N/A

Availability: N/A

MEDIUM 6,5

Source: [email protected]

Attack Vector: network

Attack Complexity: low

Privileges Required: none

User Interaction: none

Scope: unchanged

Confidentiality: low

Integrity: low

Availability: none

Description

Docker-Proxy through 5.1.9 contains a missing authentication vulnerability in the hubcmdui routes/config.js that allows unauthenticated attackers to read and overwrite configuration via /api/config. Attackers can retrieve the WeChat webhook URL and Telegram bot token, and overwrite menuItems links, proxyDomain, and the monitoring webhook destination receiving alerts.

306

Missing Authentication for Critical Function

Draft

Abstraction: Base Structure: Simple

Common Consequences

Security Scopes Affected:

Access Control Other

Potential Impacts:

Gain Privileges Or Assume Identity Varies By Context

Applicable Platforms

Technologies: Cloud Computing, ICS/OT

Likelihood of Exploit: High

View CWE Details

https://github.com/dqzboy/Docker-Proxy

https://github.com/dqzboy/Docker-Proxy

https://github.com/dqzboy/Docker-Proxy/blob/4fa5a4baaeb73a9…

https://github.com/dqzboy/Docker-Proxy/blob/4fa5a4baaeb73a9a4e317b6c7fc5db72833…

https://github.com/dqzboy/Docker-Proxy/commit/a173befc5d163…

https://github.com/dqzboy/Docker-Proxy/commit/a173befc5d163b1206b40298871153026…

https://github.com/dqzboy/Docker-Proxy/issues/109

https://github.com/dqzboy/Docker-Proxy/issues/109

https://www.vulncheck.com/advisories/docker-proxy-through-5…

https://www.vulncheck.com/advisories/docker-proxy-through-5.1.9-missing-authent…