CVE-2026-110130: critical vulnerability in Finsys dockhand
Dockhand before 1.0.45 Authentication Bypass via Static-Asset Check
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
28Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 10epss 0.7%
Dockhand before 1.0.45 contains an authentication bypass in which the global auth hook skips authentication for any path ending in a static-asset extension such as .js, including /api/* routes, and the user-mutation handlers fail open for unauthenticated callers. Unauthenticated remote attackers can send a PUT request to /api/users/<id>.js to reset the admin's or any user's password and take over the account.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Affected products
Finsys · dockhandRelated CVEs — Finsys dockhand
In the same product, most dangerous first.
CVE-2026-53988CRITICALDockhand < 1.0.40 Unauthenticated Webhook Trigger via Git Webhook EndpointsEPSS 0.5%CVE-2026-110112CRITICALDockhand before 1.0.50 OIDC Privilege Escalation via Missing Token Claim ValidationEPSS 0.4%CVE-2026-113354HIGHDockhand before 1.0.46 Arbitrary File Read via /api/system/files/contentEPSS 0.4%CVE-2026-110256MEDIUMDockhand before 1.0.19 Username Enumeration via LDAP Injection in tryLdapAuthEPSS 0.4%CVE-2026-57169CRITICALDockhand: Unauthenticated container exec via WebSocket upgradeEPSS 0.3%CVE-2026-110255HIGHDockhand before 1.0.43 SSRF via /api/templates/compose EndpointEPSS 0.3%