Authentication Bypass in Dockhand via Static Extension Path Traversal

Dockhand versions prior to 1.0.45 are affected by a critical authentication bypass vulnerability (CVE-2026-110130) located in the global authentication hook mechanism. The vulnerability stems from an insecure implementation where the application skips authentication checks for any HTTP request path ending in a static-asset extension, such as .js.

Defenders must note that this bypass extends to the /api/* routing namespace. Because the user-mutation handlers in these versions fail open for unauthenticated callers, an attacker can craft a PUT request to specific API endpoints by appending a static extension (e.g., /api/users/<id>.js). This allows unauthenticated remote actors to interact with sensitive user-management functions, such as resetting the password for any account including administrative users, ultimately leading to total system compromise and account takeover.

Impact

Successful exploitation results in full account takeover, including administrative access to the Dockhand platform. This enables unauthorized actors to manage system configurations, exfiltrate sensitive data, and perform destructive actions within the application environment. The severity is marked as critical (CVSS 10.0), given the ease of exploitation and the high level of access granted to an attacker.

Recommendation

• Patch the application immediately by upgrading Dockhand to version 1.0.45 or later.
• Implement web application firewall (WAF) rules to inspect and block PUT requests to /api/users/ routes that contain file extensions in the URL path.
• Audit webserver and application logs for suspicious PUT requests targeting the /api/users/ endpoint, specifically those ending in .js extensions.
• Deploy the Sigma rules in this brief to detect anomalous API access patterns if direct patching is delayed.