Read the docs
TI-2026-73417 Aliases CVE-2026-110112GHSA-2v42-28fc-4w3q

Finsys Dockhand OIDC privilege escalation via missing claim checks

Priority MEDIUM 42CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Attack requirements
Present
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-863.

Summary

Dockhand before 1.0.50 is affected by a privilege escalation flaw in its OIDC login handling. The code does not validate the iss, aud, nonce and exp token claims, so users from another tenant can gain admin access. An attacker with admin rights in another tenant of a shared provider such as Microsoft Entra ID can recreate the mapped admin group and log in as Dockhand administrators. This is classified as incorrect authorization (CWE-863).

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Dockhand before 1.0.50 contains a privilege escalation vulnerability that allows users from another tenant to gain admin access because OIDC iss, aud, nonce and exp claims are not validated. Attackers with admin rights in another tenant of a shared provider like Microsoft Entra ID can recreate the mapped admin group and log in as Dockhand administrators.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00391 33rd percentileScored 2026-11-07
Fix Fixed dockhand (Finsys): 1.0.50

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Finsysdockhandbefore 1.0.501.0.50Patch availableCNA
  • dockhand VendorFinsys Affected before 1.0.50 Fixed in 1.0.50 Patch available CNA

Remediation

Update Finsys Dockhand to version 1.0.50 or later. CISA does not list this vulnerability in its Known Exploited Vulnerabilities catalog.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA dockhand (Finsys) Fixed in 1.0.50

Timeline

  1. 2026-10-13 Threatist record created from CVE-2026-110112
  2. 2026-10-13 Alias added: GHSA-2v42-28fc-4w3q
  3. 2026-10-18 CISA SSVC decision points changed

References

Advisory 1

  • TI-2026-73418 Authentication bypass in Finsys Dockhand via static-asset check CVSS 4.0CRITICAL 10.0
  • TI-2026-73458 Server-side request forgery in Finsys Dockhand template endpoint CVSS 4.0HIGH 8.4
  • TI-2026-84331 Secret disclosure in Dockhand via Git stack webhook CVSS 4.0HIGH 7.1
  • TI-2026-76803 Dockhand Arbitrary File Read via /api/system/files/content CVSS 4.0HIGH 7.1
  • TI-2026-73459 LDAP injection in Dockhand enables username enumeration CVSS 4.0MEDIUM 6.3
  • TI-2026-75363 Unauthenticated command execution in Dockhand container terminal CVSS 3.1CRITICAL 9.6
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences