Skip to content
Heist/ feed
Back to feed
Critical

Dockhand < 1.0.40 Unauthenticated Webhook Trigger via Git Webhook Endpoints

Type: advisorySources: OSV

Dockhand before 1.0.40 contains an authentication bypass vulnerability in its git webhook endpoints that allows unauthenticated remote attackers to trigger arbitrary stack redeployments by exploiting a null webhook secret guard condition. Attackers can enumerate sequential stack IDs and send unsigned webhook requests to force git clone and docker compose operations, enabling denial of service or, when combined with write access to the tracked git branch, container escape and full host compromise via attacker-controlled docker-compose.yml with privileged bind mounts.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-53988
Confirmed fixed CVEs
Not specified
Updated in this feed
3 Nov 2026, 02:46 UTC · Revision 1

Source evidence

Dockhand < 1.0.40 Unauthenticated Webhook Trigger via Git Webhook Endpoints

core-osv · Original source

Published 29 Sept 2026, 19:55 UTC

Dockhand before 1.0.40 contains an authentication bypass vulnerability in its git webhook endpoints that allows unauthenticated remote attackers to trigger arbitrary stack redeployments by exploiting a null webhook secret guard condition. Attackers can enumerate sequential stack IDs and send unsigned webhook requests to force git clone and docker compose operations, enabling denial of service or, when combined with write access to the tracked git branch, container escape and full host compromise via attacker-controlled docker-compose.yml with privileged bind mounts.

osv:CVE-2026-53988
Complete source record
{
  "id": "288d38bfdaef506bbb43a5cc29026e1b05abecc419e4c4287808ec238570c11b",
  "url": "https://osv.dev/vulnerability/CVE-2026-53988",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Dockhand < 1.0.40 Unauthenticated Webhook Trigger via Git Webhook Endpoints",
    "summary": "Dockhand before 1.0.40 contains an authentication bypass vulnerability in its git webhook endpoints that allows unauthenticated remote attackers to trigger arbitrary stack redeployments by exploiting a null webhook secret guard condition. Attackers can enumerate sequential stack IDs and send unsigned webhook requests to force git clone and docker compose operations, enabling denial of service or, when combined with write access to the tracked git branch, container escape and full host compromise via attacker-controlled docker-compose.yml with privileged bind mounts.",
    "evidence": "osv:CVE-2026-53988",
    "products": [],
    "severity": "critical",
    "structured": {
      "id": "CVE-2026-53988",
      "aliases": [
        "CVE-2026-53988"
      ],
      "metrics": [
        {
          "type": "CVSS_V4",
          "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:H/SI:H/SA:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/finsys/dockhand",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "a115a5f5395f22b1324b21ef829bfffba86d03a2"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "1.0.40"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                  },
                  {
                    "range": [
                      {
                        "fixed": "a115a5f5395f22b1324b21ef829bfffba86d03a2"
                      }
                    ],
                    "source": "REFERENCES_TAG",
                    "original_tag": "v1.0.40"
                  },
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "1.0.40"
                      }
                    ],
                    "source": "DESCRIPTION"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v1.0.39",
            "v1.0.38",
            "v1.0.37",
            "v1.0.36",
            "v1.0.35",
            "v1.0.34",
            "v1.0.33",
            "v1.0.32",
            "v1.0.31",
            "v1.0.30",
            "v1.0.29",
            "v1.0.28",
            "v1.0.27",
            "v1.0.26"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53988.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:25.548540308Z",
      "provider": "osv",
      "references": [
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53988.json",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-53988",
        "https://www.vulncheck.com/advisories/dockhand-unauthenticated-webhook-trigger-via-git-webhook-endpoints",
        "https://github.com/Finsys/dockhand/releases/tag/v1.0.40",
        "https://github.com/Finsys/dockhand"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-306"
        ],
        "cna_assigner": "VulnCheck",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53988.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-53988",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 491979,
  "published_at": "2026-09-29T19:55:59.316+00:00"
}