CVE-2026-121449: fallo de gravedad alta en Finsys dockhand
Dockhand 1.0.47 before 1.0.54 Secret Disclosure via Git Stack Webhook
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 7.1epss 0.4%
Dockhand from 1.0.47 before 1.0.54 exposes plaintext stack secrets because deployStack() attaches resolved secret values to its result as resolvedSecrets, which Git-stack routes return unfiltered. Holders of a stack's webhook secret or users with stacks:start permission can trigger the Git stack webhook, manual deploy, or create-and-deploy endpoints to receive stored and external-provider secrets such as 1Password or Vault values.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Productos afectados
Finsys · dockhandCVEs relacionadas — Finsys dockhand
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-110130CRITICALDockhand before 1.0.45 Authentication Bypass via Static-Asset CheckEPSS 0.7%CVE-2026-121448HIGHDockhand before 1.0.54 Path Traversal via Stack Environment RoutesEPSS 0.5%CVE-2026-53988CRITICALDockhand < 1.0.40 Unauthenticated Webhook Trigger via Git Webhook EndpointsEPSS 0.5%CVE-2026-110112CRITICALDockhand before 1.0.50 OIDC Privilege Escalation via Missing Token Claim ValidationEPSS 0.4%CVE-2026-113354HIGHDockhand before 1.0.46 Arbitrary File Read via /api/system/files/contentEPSS 0.4%CVE-2026-110256MEDIUMDockhand before 1.0.19 Username Enumeration via LDAP Injection in tryLdapAuthEPSS 0.4%