CVE Feed

    Dashboard / CVE / CVE-2026-27734

    CVE-2026-27734

    Beszel is a server monitoring platform. Prior to version 0.18.2, the hub's authenticated API endpoints GET /api/beszel/containers/logs and GET /api/beszel/containers/info pass the user-supplied "container" query parameter to the agent without validation. The agent constructs Docker Engine API URLs using fmt.Sprintf with the raw value instead of url.PathEscape(). Since Go's http.Client does not sanitize `../` sequences from URL paths sent over unix sockets, an authenticated user (including readonly role) can traverse to arbitrary Docker API endpoints on agent hosts, exposing sensitive infrastructure details. Version 0.18.4 fixes the issue.

    Published:Feb 27, 2026
    Last Modified:Apr 16, 2026
    EPS:Feb 27, 2026
    EPSS Score:0.00016
    CVSS Score:6.5

    Affected Products

    Vendor
    Beszel
    Product
    Beszel
    Vendor
    Henrygd
    Product
    Beszel

    Exploits

    https://github.com/henrygd/beszel/security/advisories/GHSA-phwh-4f42-gwf3

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High