CVE-2026-116070— Docker-Proxy through 5.1.9 Missing Authentication via hubcmdui /api/config

Quick assessment

Affected

dqzboy Docker-Proxy

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Docker-Proxy 5.1.9 及更早版本在中存在身份验证缺失漏洞，允许未经身份验证的攻击者通过接口读取并篡改配置文件。攻击者可借此获取微信（WeChat）Webhook 地址和 Telegram 机器人令牌（bot token），并篡改菜单项链接、代理域名（proxyDomain）以及用于接收告警的监控 Webhook 目标地址。

CVSS 6.5 · Medium Updated Oct 25, 2026

Possible ATT&CK Techniques 3 AI

T1070.004 · File Deletion T1059.007 · JavaScript T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Docker-Proxy through 5.1.9 Missing Authentication via hubcmdui /api/config

Source: CVE Program / CVE List V5

Vulnerability Description

Docker-Proxy through 5.1.9 contains a missing authentication vulnerability in the hubcmdui routes/config.js that allows unauthenticated attackers to read and overwrite configuration via /api/config. Attackers can retrieve the WeChat webhook URL and Telegram bot token, and overwrite menuItems links, proxyDomain, and the monitoring webhook destination receiving alerts.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

关键功能的认证机制缺失

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
dqzboy	Docker-Proxy	0 ~ 5.1.9	-

II. Public POCs for CVE-2026-116070

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-116070

请登录查看更多情报信息。

Other References for CVE-2026-116070 (5)

https://github.com/dqzboy/Docker-Proxy product
https://github.com/dqzboy/Docker-Proxy/blob/4fa5a4baaeb73a9a4e317b6c7fc5db7283380136/hubcmdui/routes/config.js#L22-L103 technical-description
https://github.com/dqzboy/Docker-Proxy/commit/a173befc5d163b1206b40298871153026fee9474 patch
https://github.com/dqzboy/Docker-Proxy/issues/109 issue-tracking
https://www.vulncheck.com/advisories/docker-proxy-through-5.1.9-missing-authentication-via-hubcmdui-api-config third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-116070

IV. Related Vulnerabilities

Same weakness: CWE-306