Docker-Proxy hubcmdui - Missing Authentication on /api/config

mediumseverity

6.5CVSS score

0.5%likelihood of exploitation, next 30 days

46%of all CVEs are less likely

Readycheck to confirm it

Docker-Proxy through 5.1.9 exposes the hubcmdui configuration endpoint /api/config without authentication. An unauthenticated remote attacker can read the full server configuration, including the WeChat/Telegram monitoring webhook URLs and bot token inside monitoringConfig, the menuItems structure and docker host settings, and can overwrite configuration via the unauthenticated POST handler. The fix restricts anonymous callers to a public subset (theme, language, logo, proxyDomain).

Impact

An unauthenticated attacker can read sensitive server configuration, including monitoring webhook URLs and bot tokens, and overwrite configuration, enabling secret disclosure and tampering with proxy and menu settings.

Fix

Upgrade Docker-Proxy to a release after 5.1.9 that restricts anonymous /api/config access to a public subset (theme, language, logo, proxyDomain).

How to confirm it

Send: GET /api/config
Positive when: contains "\"monitoringConfig\"" and "\"menuItems\"" AND contains in content_type "application/json" AND status 200

Run it with nuclei: nuclei -id CVE-2026-116070 -u <target>

The full check

id: CVE-2026-116070

info:
  name: Docker-Proxy hubcmdui - Missing Authentication on /api/config
  author: kosoyyagent
  severity: medium
  description: |
    Docker-Proxy through 5.1.9 exposes the hubcmdui configuration endpoint /api/config without authentication. An unauthenticated remote attacker can read the full server configuration, including the WeChat/Telegram monitoring webhook URLs and bot token inside monitoringConfig, the menuItems structure and docker host settings, and can overwrite configuration via the unauthenticated POST handler. The fix restricts anonymous callers to a public subset (theme, language, logo, proxyDomain).
  impact: |
    An unauthenticated attacker can read sensitive server configuration, including monitoring webhook URLs and bot tokens, and overwrite configuration, enabling secret disclosure and tampering with proxy and menu settings.
  remediation: |
    Upgrade Docker-Proxy to a release after 5.1.9 that restricts anonymous /api/config access to a public subset (theme, language, logo, proxyDomain).
  reference:
    - https://github.com/dqzboy/Docker-Proxy/security/advisories/GHSA-xxpq-v3jg-w39m
    - https://github.com/dqzboy/Docker-Proxy/commit/a173befc5d163b1206b40298871153026fee9474
    - https://github.com/dqzboy/Docker-Proxy/issues/109
    - https://www.vulncheck.com/advisories/docker-proxy-through-5.1.9-missing-authentication-via-hubcmdui-api-config
    - https://nvd.nist.gov/vuln/detail/CVE-2026-116070
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
    cvss-score: 6.5
    cve-id: CVE-2026-116070
    epss-score: 0.00544
    epss-percentile: 0.46014
    cwe-id: CWE-306
  metadata:
    verified: true
    max-request: 1
    vendor: dqzboy
    product: docker-proxy
    shodan-query: http.html:"hubcmdui"
    fofa-query: body="hubcmdui"
  tags: cve,cve2026,docker-proxy,hubcmdui,unauth,exposure

http:
  - raw:
      - |
        GET /api/config HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"monitoringConfig"'
          - '"menuItems"'
        condition: and

      - type: word
        part: content_type
        words:
          - "application/json"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from