CVE-2026-121449— Dockhand 1.0.47 before 1.0.54 Secret Disclosure via Git Stack Webhook

Quick assessment

Affected

Finsys dockhand

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 1.0.47 版本之后、1.0.54 版本之前的 Dockhand 中，方法会将已解析的密钥值以字段附加到其返回结果中，而 Git-stack 的路由会直接返回这些未经过滤的数据，从而导致明文堆栈密钥泄露。任何拥有堆栈 Webhook 密钥的用户，或具备权限的用户，均可通过触发 Git 堆栈的 Webhook、手动部署或“创建并部署”端点，获取已存储的密钥以及来自外部提供商（如 1Password 或 HashiCorp Vault）的密钥值。

CVSS 6.5 · Medium Updated Nov 04, 2026

Possible ATT&CK Techniques 2 AI

T1021 · Remote Services T1003 · OS Credential Dumping

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Dockhand 1.0.47 before 1.0.54 Secret Disclosure via Git Stack Webhook

Source: CVE Program / CVE List V5

Vulnerability Description

Dockhand from 1.0.47 before 1.0.54 exposes plaintext stack secrets because deployStack() attaches resolved secret values to its result as resolvedSecrets, which Git-stack routes return unfiltered. Holders of a stack's webhook secret or users with stacks:start permission can trigger the Git stack webhook, manual deploy, or create-and-deploy endpoints to receive stored and external-provider secrets such as 1Password or Vault values.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

信息暴露

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Finsys	dockhand	1.0.47 ~ 1.0.54	-

II. Public POCs for CVE-2026-121449

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-121449

请登录查看更多情报信息。

Other References for CVE-2026-121449 (3)

https://github.com/Finsys/dockhand/commit/a08843a8d5ab1d91fa2c6c392919f9117d582471 patch
https://github.com/Finsys/dockhand/security/advisories/GHSA-w9qx-qg64-f8pf vendor-advisory
https://www.vulncheck.com/advisories/dockhand-1.0.47-before-1.0.54-secret-disclosure-via-git-stack-webhook third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-121449

IV. Related Vulnerabilities

Same product: dockhand

Same vendor: Finsys

Same weakness: CWE-200