Read the docs
TI-2026-73457 Aliases CVE-2026-110254GHSA-hvwx-hhfv-4fvx

Server-side request forgery in Finsys Dockhand via IPv6 transition addresses

Priority LOW 24CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Finsys Dockhand before 1.0.45 contains a server-side request forgery flaw (CWE-918) in the ipCategory() function, which does not check NAT64, 6to4 and Teredo IPv6 transition ranges. An authenticated attacker with low privileges can embed loopback, cloud metadata or private IPv4 addresses in transition IPv6 literals in notification, backup, template, registry, git or secret provider URLs to reach internal services.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Finsys Dockhand before 1.0.45 contains a server-side request forgery vulnerability in the ipCategory() function in src/lib/server/url-safety.ts, which fails to check NAT64, 6to4, and Teredo IPv6 transition ranges. Authenticated attackers can embed loopback, cloud metadata, or private IPv4 addresses in transition IPv6 literals within notification, backup, template, registry, git, or secret provider URLs to reach internal services.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00253 16th percentileScored 2026-11-07
Fix Fixed dockhand (Finsys): 1.0.45

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Finsysdockhandbefore 1.0.451.0.45Patch availableCNA
  • dockhand VendorFinsys Affected before 1.0.45 Fixed in 1.0.45 Patch available CNA

Remediation

Update Finsys Dockhand to version 1.0.45 or later.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA dockhand (Finsys) Fixed in 1.0.45

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Finsys dockhand 1.0.45

    2 records Highest priority Priority HIGH 1 HIGH, 1 LOW

    Other records, highest priority first

    • TI-2026-73418 Authentication bypass in Finsys Dockhand via static-asset checkPriority HIGH 82
    Show all 2 records →

Timeline

  1. 2026-10-13 Threatist record created from CVE-2026-110254
  2. 2026-10-13 Alias added: GHSA-hvwx-hhfv-4fvx
  3. 2026-10-15 CISA SSVC decision points changed

References

Advisory 1

  • TI-2026-73418 Authentication bypass in Finsys Dockhand via static-asset check CVSS 4.0CRITICAL 10.0
  • TI-2026-73458 Server-side request forgery in Finsys Dockhand template endpoint CVSS 4.0HIGH 8.4
  • TI-2026-84331 Secret disclosure in Dockhand via Git stack webhook CVSS 4.0HIGH 7.1
  • TI-2026-76803 Dockhand Arbitrary File Read via /api/system/files/content CVSS 4.0HIGH 7.1
  • TI-2026-73459 LDAP injection in Dockhand enables username enumeration CVSS 4.0MEDIUM 6.3
  • TI-2026-75363 Unauthenticated command execution in Dockhand container terminal CVSS 3.1CRITICAL 9.6
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences