CVE-2026-58455: Dockwatch Unauthenticated OS Command Injection

A critical unauthenticated OS command injection vulnerability, tracked as CVE-2026-58455, affects Dockwatch versions through 0.6.567. This flaw stems from a critical oversight where loader.php fails to exit after an incomplete authentication redirect, allowing attackers to "seed" a necessary session flag. Subsequently, unsanitized user input passed to the shell_exec() function within ajax/compose.php can be leveraged for arbitrary command execution. Attackers can inject malicious shell commands via the composePath POST parameter during the composePull action. This vulnerability leads to full host compromise, a severe risk for organizations using Dockwatch, particularly if the standard deployment includes mounting the Docker socket, which could facilitate container escapes or further system access. Defenders must patch immediately to prevent exploitation.

Attack Chain

1. Incomplete Authentication Bypass: An unauthenticated attacker initiates a request to loader.php to exploit a missing exit() after an authentication redirect, allowing them to seed a required session flag.
2. Crafted HTTP POST Request: The attacker then sends a specially crafted HTTP POST request to the /ajax/compose.php endpoint of the vulnerable Dockwatch instance.
3. Command Injection Payload: This POST request includes the composePath parameter, which contains unsanitized arbitrary shell commands (e.g., composePath=;id; or composePath=;cat /etc/passwd;).
4. Remote Command Execution: The Dockwatch application processes the composePath parameter and, due to a lack of proper input sanitization, passes the attacker-controlled input directly to the shell_exec() function.
5. Host Compromise: The injected shell commands are executed on the underlying operating system with the privileges of the Dockwatch process, granting the attacker control over the host.
6. Privilege Escalation/Lateral Movement: If the Docker socket is mounted (a common deployment scenario for container management tools), the executed commands can interact with the Docker daemon, potentially enabling container escape, privilege escalation, or lateral movement within the host or network.
7. Impact Achieved: Full host compromise is achieved, enabling data exfiltration, deployment of further malicious payloads (e.g., ransomware, backdoors), or continued attack activities.

Impact

The successful exploitation of CVE-2026-58455 results in full host compromise, allowing unauthenticated remote attackers to execute arbitrary operating system commands. This provides attackers complete control over the compromised Dockwatch server, enabling them to steal sensitive data, deploy ransomware or other malicious software, establish persistent access, or pivot to other systems within the network. If the Docker socket is mounted, attackers can manipulate containers, potentially escaping to the host system or accessing containerized applications and data. The high CVSS v3.1 Base Score of 9.8 reflects the critical nature of this vulnerability.

Recommendation

• Immediately patch Dockwatch to a version beyond 0.6.567 to remediate CVE-2026-58455.
• Deploy the Sigma rule provided in this brief to your SIEM to detect attempts at exploiting CVE-2026-58455.
• Enable comprehensive web server logging for all Dockwatch instances, specifically capturing cs-method, cs-uri-stem, cs-uri-query, and sc-status to facilitate detection of exploitation attempts.
• Review web server access logs for any suspicious POST requests to /ajax/compose.php containing shell metacharacters in the composePath query parameter as described in the attack chain.