CVE-2026-121449
mediumDockhand from 1.0.47 before 1.0.54 exposes plaintext stack secrets because deployStack() attaches resolved secret values to its result as resolvedSecrets, whic…
Dockhand from 1.0.47 before 1.0.54 exposes plaintext stack secrets because deployStack() attaches resolved secret values to its result as resolvedSecrets, which Git-stack routes return unfiltered. Holders of a stack's webhook secret or users with stacks:start permission can trigger the Git stack webhook, manual deploy, or create-and-deploy endpoints to receive stored and external-provider secrets such as 1Password or Vault values.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/Finsys/dockhand/commit/a08843a8d5ab1d91fa2c6c392919f9117d582471 disclosure@vulncheck.com
- https://github.com/Finsys/dockhand/security/advisories/GHSA-w9qx-qg64-f8pf disclosure@vulncheck.com
- https://www.vulncheck.com/advisories/dockhand-1.0.47-before-1.0.54-secret-disclosure-via-g... disclosure@vulncheck.com
- https://github.com/Finsys/dockhand/security/advisories/GHSA-w9qx-qg64-f8pf 134c704f-9b21-4f2e-91b3-4a467353bcc0