Server-Side Request Forgery in Finsys Dockhand
CVE-2026-110254

5.3MEDIUM

Key Information:

Vendor

Finsys

Status
Dockhand
Vendor
CVE Published:
13 October 2026

What is CVE-2026-110254?

Finsys Dockhand prior to version 1.0.45 is vulnerable to a server-side request forgery (SSRF) flaw in the ipCategory() function, located in src/lib/server/url-safety.ts. This vulnerability arises from inadequate checks for NAT64, 6to4, and Teredo IPv6 transition ranges. An authenticated attacker can exploit this weakness by embedding loopback addresses, cloud metadata, or private IPv4 addresses in transition IPv6 literals within various URL schemes, such as notification, backup, template, registry, git, or secret provider URLs, enabling them to inadvertently access internal services.

Affected Version(s)

dockhand 0 < 1.0.45

dockhand 1.0.45

References

https://github.com/Finsys/dockhand/security/advisories/GH...
vendor-advisory
https://www.vulncheck.com/advisories/dockhand-before-1.0....
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.