CVE-2026-116070

Docker-Proxy through 5.1.9 Missing Authentication via hubcmdui /api/config

Published Oct 25, 2026 CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Description

Docker-Proxy through 5.1.9 contains a missing authentication vulnerability in the hubcmdui routes/config.js that allows unauthenticated attackers to read and overwrite configuration via /api/config. Attackers can retrieve the WeChat webhook URL and Telegram bot token, and overwrite menuItems links, proxyDomain, and the monitoring webhook destination receiving alerts.

Analysis

Technical impact

Docker-Proxy versions up to 5.1.9 expose a missing authentication flaw in the hubcmdui routes/config.js endpoint. An attacker who reaches the /api/config API can read the entire configuration file and overwrite critical settings, including the WeChat webhook URL, Telegram bot token, menu items, proxy domain, and monitoring webhook destination. This flaw enables the theft of sensitive integration credentials and the modification of service behavior, compromising confidentiality, integrity, and potentially availability of the proxy environment.

Affected Systems

The vulnerability affects the dqzboy Docker-Proxy product, specifically all releases through version 5.1.9. System administrators running Docker-Proxy 5.1.9 or earlier are exposed to the stated risks.

Risk and Exploitability

The CVSS score of 6.9 indicates a moderate severity vulnerability. No EPSS data is available, but the flaw is exploitable via a publicly accessible API without any authentication. The vulnerability is not listed in the CISA KEV catalog, suggesting it has not yet been observed in widespread exploitation. However, the ability to read and modify configuration files can lead to credential leakage and service disruption, so the risk remains significant, especially on exposed deployments.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

dqzboy

Docker-Proxy

unaffected

Version	Status	Constraints
`0`	affected	≤ 5.1.9

No data.

Vendor Product Versions

Dqzboy

Docker-proxy

Version	Status	Scheme	Platform
`[0,5.1.9]`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Docker-Proxy to the latest released version that fixes the authentication issue for the /api/config endpoint.
Restrict network access to /api/config using firewall rules or container network policies so that only trusted hosts can interact with it.
After updating, rotate any exposed WeChat webhook URLs, Telegram bot tokens, and other secrets that may have been read through the compromised endpoint, and ensure the configuration file no longer contains sensitive data in plain text.

Generated by OpenCVE AI on October 25, 2026 at 14:23 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.544% probability within 30 days)

Exploitation poc

Automatable yes

Technical Impact partial

References

Link	Providers
https://github.com/dqzboy/Docker-Proxy
https://github.com/dqzboy/Docker-Proxy/blob/4fa5a4baaeb73a9a4e317b6c7fc5db7283380136/hubcmdui/routes/config.js#L22-L103
https://github.com/dqzboy/Docker-Proxy/commit/a173befc5d163b1206b40298871153026fee9474
https://github.com/dqzboy/Docker-Proxy/issues/109
https://www.vulncheck.com/advisories/docker-proxy-through-5.1.9-missing-authentication-via-hubcmdui-api-config

History

Oct 31, 2026 10:30 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Oct 26, 2026 7:15 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Dqzboy Dqzboy docker-proxy
Vendors & Products		Dqzboy Dqzboy docker-proxy

Oct 25, 2026 12:30 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Docker-Proxy through 5.1.9 contains a missing authentication vulnerability in the hubcmdui routes/config.js that allows unauthenticated attackers to read and overwrite configuration via /api/config. Attackers can retrieve the WeChat webhook URL and Telegram bot token, and overwrite menuItems links, proxyDomain, and the monitoring webhook destination receiving alerts.
Title		Docker-Proxy through 5.1.9 Missing Authentication via hubcmdui /api/config
Weaknesses		CWE-306
References		https://github.com/dqzboy/Docker-Proxy https://github.com/dqzboy/Docker-Proxy/blob/4fa5a4baaeb73a9a4e317b6c7fc5db7283380136/hubcmdui/routes/config.js#L22-L103 https://github.com/dqzboy/Docker-Proxy/commit/a173befc5d163b1206b40298871153026fee9474 https://github.com/dqzboy/Docker-Proxy/issues/109 https://www.vulncheck.com/advisories/docker-proxy-through-5.1.9-missing-authentication-via-hubcmdui-api-config
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N'}` cvssV4_0 `{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N'}`