CVE-2026-58455 -- CVSS 9.8 Vulnerability Briefing

CVE-2026-58455 | CVSS 9.8 (Critical) | Exploit: No known exploit

What Is It

CVE-2026-58455 is an unauthenticated OS command injection vulnerability in Dockwatch, a container monitoring and management application, affecting versions through 0.6.567.

Technical Detail

The flaw stems from a missing exit() call following an authentication check, which allows the application to continue processing requests that should have been rejected, effectively bypassing authentication enforcement. A remote, unauthenticated attacker can supply crafted input to inject arbitrary shell commands that are executed in the context of the application process. Successful exploitation results in unauthenticated remote code execution (RCE) on the host system, with potential for full container host compromise depending on deployment configuration.

Exploitation Status

No known exploit code has been publicly observed or confirmed as of July 09, 2026. This vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Despite the absence of a known exploit, the unauthenticated nature and critical CVSS score of 9.8 indicate low exploitation complexity, meaning functional exploit development is likely straightforward for a capable attacker.

Who Is Targeting This

No specific threat actor attribution at this time. No confirmed or reported threat actor activity has been associated with this vulnerability as of the publication date.

What To Do

Operators running Dockwatch should update to a version beyond 0.6.567 immediately if a patched release is available from the vendor. Given the critical severity and unauthenticated attack vector, this should be treated as a high-priority patch. If an update is not yet available, restrict network access to the Dockwatch interface using firewall rules or network segmentation, ensuring the management interface is not exposed to untrusted networks or the public internet. Detection efforts should focus on anomalous process spawning from the Dockwatch application process, unexpected outbound network connections originating from container management services, and any shell execution events tied to the application's runtime user. Review container host logs for signs of lateral movement or privilege escalation following any suspicious Dockwatch activity.