CVE-2021-27886: Docker Dashboard command injection in terminal API endpoint

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable OS command injection with CVSS 9.8 and high EPSS makes this an urgent patch-or-isolate case.

What it is

rakibtg Docker Dashboard before 2021-02-28 passes the command parameter of an API request into a shell in backend/utilities/terminal.js without sanitizing shell metacharacters. This is an OS command injection flaw in a third-party project, not a Docker, Inc. product. It matters because the endpoint is network-reachable and unauthenticated, giving remote code execution on the host running the dashboard.

Impact

An attacker can execute arbitrary OS commands with the privileges of the dashboard process, leading to full compromise of the host and any containers or credentials it can reach.

Attack surface

Reached over the network via an API request to the terminal endpoint, with no authentication and no user interaction required per the CVSS vector (AV:N/AC:L/PR:N/UI:N). The command parameter is the injection point.

Exploitation

Not listed in CISA KEV and no ransomware associations are recorded, but EPSS is high at roughly 0.456 (98.7th percentile), and public references include a Packet Storm advisory and a patch commit, indicating public technical detail exists.

What to do

• Apply the upstream fix in commit 79cdc41809f2030fce21a1109898bd79e4190661 or upgrade to a build dated 2021-02-28 or later.
• If patching is not possible, remove or disable the terminal API endpoint and the dashboard's command execution feature.
• Do not expose the dashboard to untrusted networks; restrict access to a management network or localhost and require authentication at a reverse proxy.
• Run the dashboard as a low-privilege user with no host Docker socket access or elevated group membership.
• Replace the shell invocation with an argument-array exec call that does not interpret shell metacharacters.

Detection

• Monitor dashboard/API logs for requests to the terminal endpoint containing shell metacharacters such as ;, |, &&, $(), or backticks.
• Alert on child processes spawned by the dashboard process (node) that launch shells or unexpected binaries.
• Review host process telemetry for command lines matching the dashboard's working directory or service account.
• Audit network exposure of the dashboard port and flag any external connections to it.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.