CVE-2026-116070 dqzboy CVE debrief

Who should care

Defenders and security teams using Docker-Proxy should assess their exposure and potential impact, and take necessary actions to verify and mitigate the vulnerability. They should review the configuration settings to identify potential security risks and implement additional security measures to prevent unauthorized access to sensitive configuration information. Security teams should also review and update incident response plans to address potential Explo

Why it matters

CVE-2026-116070 is a medium-severity vulnerability in Docker-Proxy that allows unauthenticated attackers to read and overwrite configuration. Defenders should prioritize verifying exposure, assessing potential impact, and implementing necessary mitigations.

• Potential unauthorized access to sensitive configuration information
• Possible overwrite of critical configuration settings
• Risk of exposure to further attacks due to lack of authentication

Technical summary

The vulnerability exists in the hubcmdui routes/config.js file of Docker-Proxy through version 5.1.9. It allows unauthenticated attackers to read and overwrite configuration via the /api/config endpoint. The vulnerability can be exploited by retrieving sensitive information such as the WeChat webhook URL and Telegram bot token, and overwriting configuration settings like menuItems links, proxyDomain, and monitoring webhook destinations. Defenders should prioritize verifying exposure and assessing potential impact, particularly in environments using Docker-Proxy.

Defensive priority

Defenders should prioritize verifying exposure and assessing potential impact, particularly in environments using Docker-Proxy.

Recommended defensive actions

• Verify the version of Docker-Proxy in use and assess exposure
• Review and restrict access to the /api/config endpoint
• Implement authentication and authorization for the hubcmdui routes/config.js file
• Monitor for potential exploitation attempts
• Perform a thorough review of the configuration settings to identify potential security risks
• Implement additional security measures to prevent unauthorized access to sensitive configuration information
• Review and update incident response plans to address potential exploitation of this vulnerability

Evidence notes

The vulnerability allows attackers to retrieve sensitive information such as the WeChat webhook URL and Telegram bot token, and overwrite configuration settings like menuItems links, proxyDomain, and monitoring webhook destinations.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.