CVE-2026-58455: Dockwatch 0.6.567 Unauthenticated OS Command Injection via ajax/compose.php

Synopsis

Unauthenticated OS command injection in Dockwatch (versions through 0.6.567) allows a remote attacker with no credentials to execute arbitrary shell commands on the host. The flaw combines a missing exit() after an authentication redirect in loader.php with unsanitized input passed to shell_exec() in ajax/compose.php, reachable over the network without any login. Successful exploitation gives the attacker full control of the host, amplified by Dockwatch's standard deployment pattern of mounting the Docker socket. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint in ajax/compose.php is exposed over the network, meaning an attacker must be able to reach the Dockwatch HTTP service from a remote host.

• AuthenticationNot required

  No credentials are needed; the flaw stems from a missing exit() after the auth redirect, allowing the attacker to bypass authentication entirely and seed the required session flag without logging in.

• Victim interactionNot required

  Exploitation is fully server-side via a crafted POST request; no user action or social-engineering step is required.

• Attack complexityDetail

  The CVSS v4.0 vector specifies AC:L (low complexity) with AT:P (attack requirements present), meaning the exploit itself is straightforward and reliable but depends on the attacker reaching the service and meeting the session-seeding precondition described in the vulnerability.

Blast Radius

• Attacker executes arbitrary shell commands as the Dockwatch process user, gaining full filesystem read and write access on the host.
• Via the Docker socket mounted into the container by default, the attacker can create, modify, or destroy any container on the host and pivot to other running workloads.
• Confidential data stored or accessible on the host, including environment variables, secrets files, and mounted volumes, is readable and exfiltrable.
• The attacker can install persistent processes or backdoors, effectively achieving a full host compromise that survives container restarts.