/Vulnerability Library

Docker-Proxy hubcmdui - Missing Authentication on /api/config

CVE-2026-116070
Early Release

Description

Docker-Proxy through 5.1.9 exposes the hubcmdui configuration endpoint /api/config without authentication. An unauthenticated remote attacker can read the full server configuration, including the WeChat/Telegram monitoring webhook URLs and bot token inside monitoringConfig, the menuItems structure and docker host settings, and can overwrite configuration via the unauthenticated POST handler. The fix restricts anonymous callers to a public subset (theme, language, logo, proxyDomain).

Severity

Medium

CVSS Score

6.5

Affected Product

docker-proxy

Published Date

October 27, 2026

Template Author

kosoyyagent

CVE-2026-116070.yaml
6.5Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVE ID:
cve-2026-116070
CWE ID:
cwe-306

References

https://github.com/dqzboy/Docker-Proxy/security/advisories/GHSA-xxpq-v3jg-w39mhttps://github.com/dqzboy/Docker-Proxy/commit/a173befc5d163b1206b40298871153026fee9474https://github.com/dqzboy/Docker-Proxy/issues/109https://www.vulncheck.com/advisories/docker-proxy-through-5.1.9-missing-authentication-via-hubcmdui-api-confighttps://nvd.nist.gov/vuln/detail/CVE-2026-116070

Remediation Steps

Upgrade Docker-Proxy to a release after 5.1.9 that restricts anonymous /api/config access to a public subset (theme, language, logo, proxyDomain).