Dockhand prior to version 1.0.40 suffers from an authentication bypass in its Git webhook endpoints caused by a null check on the webhook secret. Unauthenticated attackers can send unsigned webhook requests to trigger arbitrary stack redeployments. The resulting git clone and docker compose operations may lead to denial of service, and if the attacker also has write access to the tracked Git branch, they can inject a malicious docker-compose.yml with privileged bind mounts, enabling container escape and full host compromise.

The affected product is Finsys Dockhand. All releases before 1.0.40 are impacted. No later version mentions the fix.

The CVSS score of 9.2 indicates a high severity vulnerability with likely impact on confidentiality, integrity, and availability. The EPSS score is not available, so current exploitation probability is unknown; however, the vulnerability is exploitable remotely via HTTP requests to the Git webhook endpoints and does not require authentication credentials. The vulnerability is not listed in the CISA KEV catalog, but its high CVSS and lack of authentication barrier make it attractive to adversaries. An attacker needs only to enumerate or guess sequential stack identifiers and send unsigned webhook payloads to perform the exploit.