CVE-2026-53988: Critical Dockhand Webhook Authentication Bypass (CVSS 10) — Detection and Remediation Guide

---
title: Dockhand Git Webhook Unauthenticated Redeployment Request
id: 3f8a2c71-6b44-4e9a-9d21-7c5e0a1b2f34
status: experimental
description: Detects inbound POST requests to Dockhand git webhook endpoints. Unauthenticated requests to these endpoints are the exploitation vector for CVE-2026-53988. Any hits during a window when no legitimate CI/CD push occurred warrant immediate investigation.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-53988
author: Security Arsenal
date: 2026/04/10
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
detection:
  selection:
    cs-method: 'POST'
    cs-uri|contains:
      - '/webhook'
      - '/api/stacks'
  condition: selection
falsepositives:
  - Legitimate git platform webhook deliveries (GitHub/GitLab/Gitea) — correlate with source IPs of your git provider and expected deploy windows
level: high
---
title: Git Clone or Docker Compose Spawned by Dockhand Service Process
id: 9d1e5b62-3a78-4c05-b8f4-2e6a7d9031c5
status: experimental
description: Detects git clone/pull or docker compose up/down executed as a child of the Dockhand service (node) process. Exploitation of CVE-2026-53988 forces stack redeployments; redeployments outside known deploy windows or at high frequency indicate webhook abuse.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-53988
author: Security Arsenal
date: 2026/04/10
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentCommandLine|contains:
      - 'dockhand'
  selection_cmd_git:
    CommandLine|contains:
      - 'git clone'
      - 'git pull'
      - 'git fetch'
  selection_cmd_compose:
    CommandLine|contains:
      - 'docker compose up'
      - 'docker compose down'
      - 'docker compose pull'
      - 'docker-compose up'
  condition: selection_parent and 1 of selection_cmd_*
falsepositives:
  - Legitimate stack redeployments triggered by real CI/CD pushes — baseline deploy timing and alert on off-window or high-frequency executions
level: high
---
title: Docker Compose Execution with Privileged Container or Host Root Bind Mount
id: 5c7a3d08-2e19-4f66-a1b8-8d3c6e509427
status: experimental
description: Detects post-exploitation indicators of CVE-2026-53988 — docker compose configurations enabling privileged mode, host PID namespace, or bind-mounting the host root filesystem, consistent with an attacker-controlled docker-compose.yml used for container escape.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-53988
author: Security Arsenal
date: 2026/04/10
tags:
  - attack.privilege_escalation
  - attack.t1611
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    CommandLine|contains:
      - 'docker compose up'
      - 'docker-compose up'
  condition: selection
falsepositives:
  - Legitimate compose redeployments — this rule should be paired with file-content auditing of compose files for 'privileged: true', 'pid: host', and ':/host' volume mounts to raise fidelity
level: medium

// CVE-2026-53988 — Dockhand webhook auth bypass: correlate webhook POSTs with forced redeploy activity
let WebhookHits =
    CommonSecurityLog
    | where TimeGenerated > ago(14d)
    | where RequestMethod =~ "POST"
    | where RequestURL has_any ("/webhook", "/api/stacks")
    | project WebTime=TimeGenerated, SourceIP, RequestURL, DestinationHostName, RequestMethod;
let Redeploys =
    Syslog
    | where TimeGenerated > ago(14d)
    | where ProcessName has_any ("git", "docker", "docker-compose")
       or SyslogMessage has_any ("git clone", "git pull", "docker compose up", "docker compose down", "docker-compose up")
    | where SyslogMessage has_any ("clone", "pull", "compose", "stack")
    | project RedeployTime=TimeGenerated, Computer, ProcessName, SyslogMessage;
WebhookHits
| join kind=inner Redeploys on $left.DestinationHostName == $right.Computer
| where RedeployTime between (WebTime .. WebTime + 10m)
| project WebTime, SourceIP, RequestURL, DestinationHostName, RedeployTime, ProcessName, SyslogMessage
| order by WebTime desc;
// Standalone sweep: any webhook POSTs from non-git-provider source IPs (tune the allowlist to your git platform's published IP ranges)
CommonSecurityLog
| where TimeGenerated > ago(14d)
| where RequestMethod =~ "POST"
| where RequestURL has_any ("/webhook", "/api/stacks")
| where SourceIP !startswith "140.82."      // GitHub hook ranges — replace with your provider's published CIDRs
| summarize Hits=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), DistinctTargets=dcount(DestinationHostName) by SourceIP, RequestURL
| order by Hits desc;

-- CVE-2026-53988: Hunt for malicious/poisoned docker-compose files enabling container escape
-- Scope glob to your Dockhand stack/data directories (e.g. /opt/dockhand, /var/lib/dockhand, /home/*/stacks)
LET compose_files = SELECT FullPath, Mtime, Size
FROM glob(globs=['/opt/dockhand/**/docker-compose*.yml',
                 '/var/lib/dockhand/**/docker-compose*.yml',
                 '/srv/**/docker-compose*.yml',
                 '/home/*/**/docker-compose*.yml'])

SELECT FullPath,
       Mtime AS LastModified,
       read_file(filename=FullPath, length=100000) AS ComposeContent
FROM compose_files
WHERE ComposeContent =~ 'privileged:\\s*true'
   OR ComposeContent =~ 'pid:\\s*["\\']?host'
   OR ComposeContent =~ 'network_mode:\\s*["\\']?host'
   OR ComposeContent =~ '/:/host'
   OR ComposeContent =~ 'docker.sock'
ORDER BY LastModified DESC

#!/usr/bin/env bash
# CVE-2026-53988 — Dockhand webhook auth bypass: verify, patch, audit
set -euo pipefail

echo "=== [1] Identify Dockhand version ==="
# Adjust container name/image to your deployment
docker ps --filter "name=dockhand" --format '{{.Names}} {{.Image}}'
DOCKERHAND_IMG=$(docker ps --filter "name=dockhand" --format '{{.Image}}' | head -n1)
echo "Running image: ${DOCKERHAND_IMG:-NOT FOUND}"
# Vulnerable if tag < 1.0.40 — if you cannot confirm 1.0.40+, assume vulnerable and upgrade

echo "=== [2] Upgrade Dockhand to >= 1.0.40 ==="
# Pin the fixed version; then recreate via your normal compose workflow
# docker pull dockhand/dockhand:1.0.40
# docker compose -f /path/to/dockhand/docker-compose.yml pull && docker compose -f /path/to/dockhand/docker-compose.yml up -d

echo "=== [3] Verify webhook secret is set (null secret = vulnerable guard condition) ==="
# The vulnerability triggers when the webhook secret is unset. Confirm a strong secret exists in the Dockhand config/env.
docker inspect $(docker ps --filter "name=dockhand" -q | head -n1) \
  --format '{{range .Config.Env}}{{println .}}{{end}}' 2>/dev/null | grep -i -E 'webhook|secret' || \
  echo "WARNING: no webhook secret env vars visible — audit the Dockhand UI per-stack webhook configuration NOW"

echo "=== [4] Audit compose files for container-escape primitives ==="
for dir in /opt/dockhand /var/lib/dockhand /srv /home; do
  [ -d "$dir" ] || continue
  grep -rEl --include='docker-compose*.yml' --include='compose*.yml' . "$dir" 2>/dev/null | while read -r f; do
    if grep -qE 'privileged:\s*true|pid:\s*["'"'"']?host|/:/host|docker\.sock' "$f"; then
      echo "SUSPICIOUS COMPOSE FILE: $f  (mtime: $(stat -c '%y' "$f"))"
      grep -nE 'privileged:|pid:|volumes:|/:/host|docker\.sock' "$f" | head -n 20
    fi
  done
done

echo "=== [5] Review recent redeployment activity for anomalies ==="
# Look for redeploy bursts or events outside change windows since disclosure
docker events --since '14d' --until 'now' \
  --filter 'event=destroy' --filter 'event=create' --filter 'event=start' 2>/dev/null | head -n 200 || \
  journalctl -u docker --since '14 days ago' | grep -iE 'compose|stack' | tail -n 200

echo "=== [6] Network exposure check — webhook/management ports should not be world-reachable ==="
# Dockhand default UI port is commonly 3000; adjust to your deployment
ss -tlnp | grep -E ':(3000|8080|443)\b' || true
echo "Restrict the webhook path to your git provider's published source IPs at the reverse proxy/firewall."

echo "=== Done. Any SUSPICIOUS compose files or unexplained redeploy events -> invoke IR and rotate git credentials. ==="