CVE-2026-27734

Beszel is a server monitoring platform. Prior to version 0.18.2, the hub's authenticated API endpoints GET /api/beszel/containers/logs and GET /api/beszel/containers/info pass the user-supplied "container" query parameter to the agent without validation. The agent constructs Docker Engine API URLs using fmt.Sprintf with the raw value instead of url.PathEscape(). Since Go's http.Client does not sanitize `../` sequences from URL paths sent over unix sockets, an authenticated user (including readonly role) can traverse to arbitrary Docker API endpoints on agent hosts, exposing sensitive infrastructure details. Version 0.18.4 fixes the issue.

• CWE-22

• https://github.com/henrygd/beszel/releases/tag/v0.18.4Product, Release Notes
• https://github.com/henrygd/beszel/security/advisories/GHSA-phwh-4f42-gwf3Exploit, Vendor Advisory

Published

Feb 27, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-27727mchange-commons-java, a library that provides Java utilities…9.8
• CVE-2026-27728OneUptime is a solution for monitoring and managing online s…8.8
• CVE-2026-27729Astro is a web framework. In versions 9.0.0 through 9.5.3, A…7.5
• CVE-2026-2773Incorrect boundary conditions in the Web Audio component. Th…9.8
• CVE-2026-27730esm.sh is a no-build content delivery network (CDN) for web …7.5
• CVE-2026-27732WWBN AVideo is an open source video platform. Prior to versi…8.1
• CVE-2026-27735Model Context Protocol Servers is a collection of reference …6.5
• CVE-2026-27736BigBlueButton is an open-source virtual classroom. In versio…6.1
• CVE-2026-27737BigBlueButton is an open-source virtual classroom. In versio…6.5
• CVE-2026-27738The Angular SSR is a server-rise rendering tool for Angular …6.9
• CVE-2026-27739The Angular SSR is a server-rise rendering tool for Angular …9.2
• CVE-2026-2774Integer overflow in the Audio/Video component. This vulnerab…9.8