CVE-2026-73040 louislam CVE debrief

Who should care

Administrators and users of Dockge, especially those running it as root or with access to the Docker socket, should be aware of this vulnerability and take immediate action to mitigate the risk. This includes verifying input validation for stack names, ensuring proper authorization for stack operations, and monitoring for unusual file access or deletion. Additionally, operators of platforms that utilize Dockge, vulnerability management teams, and security teams should review the vulnerability details and assess their exposure to mitigate potential impacts on their environments and assets effectively. Review of compensating controls and additional logging and monitoring may also be necessary to detect and respond to potential exploitation attempts. Asset inventory and configuration management may also need to be updated to reflect the vulnerability and associated risk. Rollback and change management processes should also be reviewed to ensure timely mitigation of the vulnerability in production environments. Source tracking and monitoring of security advisories related to Dockge and associated components is also recommended to ensure awareness of any future updates or additional vulnerabilities that may arise. The CVE record and associated references provide additional context for defenders to assess and mitigate this vulnerability effectively across their environments and assets. Security teams should prioritize patching or mitigating this vulnerability based on its high CVSS score and potential impact on affected systems and data confidentiality and integrity. The vulnerability's disclosure highlights the importance of robust input validation, authorization, and monitoring in preventing path traversal attacks and protecting sensitive information. Therefore, a thorough review of Dockge configurations, user access controls, and monitoring capabilities is essential to minimize the risk of exploitation and associated impacts on the organization. This may involve coordination with vendors, security researchers, and other stakeholders to ensure comprehensive mitigation and minimize potential downtime or disruption to critical systems and services. By taking proactive

Technical summary

The Dockge application validates stack names only on the write path, allowing an authenticated user to perform path traversal attacks. This can lead to disclosure of sensitive information in .env or Compose files and arbitrary directory deletion. The vulnerability is caused by the lack of input validation in the socket handlers, which pass the stack name directly to Stack.getStack without proper checks. This allows an attacker to traverse the directory structure and access files outside the managed stacks directory. The vulnerability is particularly concerning due to the potential for high impact, given that Dockge often runs as root with access to the Docker socket.

Defensive priority

Authenticated users should verify input validation for stack names, ensure proper authorization, and monitor for unusual file access or deletion.

Recommended defensive actions

• Verify input validation for stack names in Dockge
• Ensure proper authorization for stack operations
• Monitor for unusual file access or deletion
• Restrict access to sensitive directories
• Implement additional logging and monitoring

Evidence notes

The CVE details indicate a path traversal vulnerability in Dockge, allowing authenticated users to read and delete arbitrary files. Evidence is based on official CVE and NVD records, as well as source references from Vulncheck. The vulnerability is particularly concerning as Dockge often runs as root with access to the Docker socket, making the reachable set include unrelated applications on the host. Instances configured with disableAuth, a supported option that logs the caller in as admin automatically, expose both operations without authentication. Further review of the Dockge codebase and associated documentation is recommended to fully understand the scope of the vulnerability and potential mitigations.

Official resources