CRITICALVulnerability
Verified
Global

NVD CRITICAL: CVE-2026-58455 — Dockwatch through 0.6.567 contains an unauthenticated OS command injection vulne...

·Source: NIST NVD

Updated:

Executive Summary

Dockwatch through 0.6.567 contains an unauthenticated OS command injection vulnerability that allows remote attackers to execute arbitrary shell commands by exploiting a missing exit() after an authentication redirect in loader.php combined with unsanitized input passed to shell_exec() in ajax/compose.php. Attackers can seed the required session flag through the incomplete auth check, then inject

Analysis

Dockwatch through 0.6.567 contains an unauthenticated OS command injection vulnerability that allows remote attackers to execute arbitrary shell commands by exploiting a missing exit() after an authentication redirect in loader.php combined with unsanitized input passed to shell_exec() in ajax/compose.php. Attackers can seed the required session flag through the incomplete auth check, then inject arbitrary commands via the composePath POST parameter in the composePull action to achieve full host compromise, facilitated by the standard deployment mounting of the Docker socket. CVSS Score: 9.8. Published: 2026-07-02T16:16:35.287.

Indicators of Compromise (1)

CVE (1)
CVE-2026-58455
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Jul 2, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerabilityNEW

Lloyds to retire Halifax brand

The Halifax brand is set to disappear from UK high streets after 179 years as a financial institution.

Finextra
MEDIUMVulnerability

Visa launches Visa Destinations to give travellers discounted offers

Visa’s travel offer platform Visa Destinations is now live for users across 10 locations.

Finextra
CRITICALVulnerability

NVD CRITICAL: CVE-2026-4321 — Improper neutralization of special elements used in an SQL command ('SQL injecti...

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Raera - Ankara Web Design and Digital Advertising Agency Destekz allows SQL Injection. This issue affects Destekz: through 02062026. NOTE: The vendor was contacted and it was learned that the product is not supported.

CVE-2026-4321
NIST NVD