Server-Side Request Forgery in Finsys Dockhand Affects Authentication Security
CVE-2026-110255

8.4HIGH

Key Information:

Vendor

Finsys

Status
Dockhand
Vendor
CVE Published:
13 October 2026

What is CVE-2026-110255?

The Finsys Dockhand application before version 1.0.43 is susceptible to a server-side request forgery (SSRF) vulnerability. This flaw allows authenticated users to manipulate the server into fetching arbitrary URLs. By supplying crafted repository URLs and stackfile values, attackers can redirect the server to access internal services or cloud metadata endpoints. This action exposes sensitive information, including credentials and tokens, through the response generated by the compose endpoint, compromising the security of the affected environment.

Affected Version(s)

dockhand 0 < 1.0.43

dockhand 1.0.43

References

https://github.com/Finsys/dockhand/security/advisories/GH...
vendor-advisory
https://www.vulncheck.com/advisories/dockhand-before-1.0....
third-party-advisory

CVSS V4

Score:
8.4
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

1491342590
.