Vulnerability Description
Docker-Proxy through 5.1.9 contains a missing authentication vulnerability in the hubcmdui routes/config.js that allows unauthenticated attackers to read and overwrite configuration via /api/config. Attackers can retrieve the WeChat webhook URL and Telegram bot token, and overwrite menuItems links, proxyDomain, and the monitoring webhook destination receiving alerts.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/dqzboy/Docker-Proxy
- https://github.com/dqzboy/Docker-Proxy/blob/4fa5a4baaeb73a9a4e317b6c7fc5db728338
- https://github.com/dqzboy/Docker-Proxy/commit/a173befc5d163b1206b40298871153026f
- https://github.com/dqzboy/Docker-Proxy/issues/109
- https://www.vulncheck.com/advisories/docker-proxy-through-5.1.9-missing-authenti
- https://github.com/dqzboy/Docker-Proxy/issues/109
FAQ
What is CVE-2026-116070?
CVE-2026-116070 is a vulnerability with a CVSS score of 6.5 (MEDIUM). Docker-Proxy through 5.1.9 contains a missing authentication vulnerability in the hubcmdui routes/config.js that allows unauthenticated attackers to read and overwrite configuration via /api/config. A...
How severe is CVE-2026-116070?
CVE-2026-116070 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-116070?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.