CVE-2026-53988

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-53988
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53988.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-53988
Published
2026-09-29T19:55:59Z
Modified
2026-10-02T03:30:23Z
Severity
  • 9.2 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:H/SI:H/SA:H CVSS Calculator
Summary
Dockhand < 1.0.40 Unauthenticated Webhook Trigger via Git Webhook Endpoints
Details

Dockhand before 1.0.40 contains an authentication bypass vulnerability in its git webhook endpoints that allows unauthenticated remote attackers to trigger arbitrary stack redeployments by exploiting a null webhook secret guard condition. Attackers can enumerate sequential stack IDs and send unsigned webhook requests to force git clone and docker compose operations, enabling denial of service or, when combined with write access to the tracked git branch, container escape and full host compromise via attacker-controlled docker-compose.yml with privileged bind mounts.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-306"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53988.json"
}
References

Affected packages

Git / github.com/finsys/dockhand

Affected ranges

Type
GIT
Repo
https://github.com/finsys/dockhand
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
a115a5f5395f22b1324b21ef829bfffba86d03a2
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "1.0.40"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "DESCRIPTION",
        "REFERENCES"
    ]
}

Affected versions

v1.*
v1.0.26
v1.0.27
v1.0.28
v1.0.29
v1.0.30
v1.0.31
v1.0.32
v1.0.33
v1.0.34
v1.0.35
v1.0.36
v1.0.37
v1.0.38
v1.0.39

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53988.json"