CVE-2026-110255: high-severity vulnerability in Finsys dockhand
Dockhand before 1.0.43 SSRF via /api/templates/compose Endpoint
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.4epss 0.3%
Finsys Dockhand before 1.0.43 contains a response-disclosing server-side request forgery vulnerability that allows authenticated users to make the server fetch arbitrary URLs by supplying repository URL and stackfile values. Attackers can send stack templates pointing to internal services or cloud metadata endpoints and read the fetched content from the compose response field, exposing credentials and tokens.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N
Affected products
Finsys · dockhandRelated CVEs — Finsys dockhand
In the same product, most dangerous first.
CVE-2026-110130CRITICALDockhand before 1.0.45 Authentication Bypass via Static-Asset CheckEPSS 0.7%CVE-2026-121448HIGHDockhand before 1.0.54 Path Traversal via Stack Environment RoutesEPSS 0.5%CVE-2026-53988CRITICALDockhand < 1.0.40 Unauthenticated Webhook Trigger via Git Webhook EndpointsEPSS 0.5%CVE-2026-121449HIGHDockhand 1.0.47 before 1.0.54 Secret Disclosure via Git Stack WebhookEPSS 0.4%CVE-2026-110112CRITICALDockhand before 1.0.50 OIDC Privilege Escalation via Missing Token Claim ValidationEPSS 0.4%CVE-2026-113354HIGHDockhand before 1.0.46 Arbitrary File Read via /api/system/files/contentEPSS 0.4%