Privilege Escalation in Dockhand by Finsys for Azure Users

CVE-2026-110112

What is CVE-2026-110112?

Dockhand prior to version 1.0.50 is susceptible to a privilege escalation vulnerability. This issue arises from the lack of proper validation for OIDC claims such as iss, aud, nonce, and exp. Consequently, it enables users from one tenant to gain administrative access within another tenant's environment. Attackers with existing admin credentials in a shared platform like Microsoft Entra ID can exploit this flaw to recreate the mapped admin group and log in as administrators of Dockhand. It highlights the critical need for stringent validation mechanisms in multi-tenant systems.

References