CVE-2026-121449

    Dashboard / Vulnerabilities / CVE-2026-121449

    CVE-2026-121449

    Published: 3 Nov 2026Last Modified: 5 Nov 2026

    Summary: Dockhand 1.0.47 before 1.0.54 Secret Disclosure via Git Stack Webhook

    Details: Dockhand from 1.0.47 before 1.0.54 exposes plaintext stack secrets because deployStack() attaches resolved secret values to its result as resolvedSecrets, which Git-stack routes return unfiltered. Holders of a stack's webhook secret or users with stacks:start permission can trigger the Git stack webhook, manual deploy, or create-and-deploy endpoints to receive stored and external-provider secrets such as 1Password or Vault values.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/121xxx/CVE-2026-121449.json, https://github.com/Finsys/dockhand/security/advisories/GHSA-w9qx-qg64-f8pf, https://nvd.nist.gov/vuln/detail/CVE-2026-121449, https://www.vulncheck.com/advisories/dockhand-1.0.47-before-1.0.54-secret-disclosure-via-git-stack-webhook, https://github.com/Finsys/dockhand/commit/a08843a8d5ab1d91fa2c6c392919f9117d582471

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 2a9299f932271fb6c0e2bccb0e64b096da463731
    Fixed -9efea8ba2e1e8779441a9b99c101a03f19ca515f

    Affected versions

    v1.0.53
    v1.0.52
    v1.0.51
    v1.0.50
    v1.0.49
    v1.0.48
    v1.0.47

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-121449 | CVE-DB