This vulnerability exists in Dockhand, a Docker management application, where the in-browser container terminal endpoint fails to enforce authentication during the WebSocket upgrade. An attacker who has network reach to the Dockhand instance and knows a container ID can establish a raw WebSocket terminal session without authenticating, allowing them to execute arbitrary commands inside the container. The impact can extend beyond the container; if the container has privileged mounts or elevated permissions, the attacker may gain host‑level compromise. This flaw qualifies as a Remote Code Execution vulnerability with a CVSS score of 9.6.

Affected product is Finsys Dockhand prior to version 1.0.34. Any deployment of Dockhand that exposes the /api/containers/<id>/exec endpoint to network traffic without authentication is susceptible. The vulnerability applies to all container containers reachable through the application, regardless of the host environment.

The CVSS 9.6 indicates a critical risk. EPSS is not available, so the current likelihood of exploitation is unknown. The vulnerability is not listed in CISA KEV. The likely attack vector is over the network to the Dockhand instance; if an attacker can reach the endpoint and determine a container ID, they can create a WebSocket connection and run commands. No authentication or privilege escalation check is required because the flaw bypasses authentication checks, making the attack trivial for a determined adversary.