Read the docs
TI-2026-73458 Aliases CVE-2026-110255GHSA-4qqc-mq6q-rhcc

Server-side request forgery in Finsys Dockhand template endpoint

Priority HIGH 70CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Finsys Dockhand before 1.0.43 contains a server-side request forgery flaw in the /api/templates/compose endpoint, classified as CWE-918. An authenticated user with low privileges can make the server fetch arbitrary URLs by supplying repository URL and stackfile values, then read the fetched content in the compose response field. Attackers can point these requests at internal services or cloud metadata endpoints to expose credentials and tokens.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Finsys Dockhand before 1.0.43 contains a response-disclosing server-side request forgery vulnerability that allows authenticated users to make the server fetch arbitrary URLs by supplying repository URL and stackfile values. Attackers can send stack templates pointing to internal services or cloud metadata endpoints and read the fetched content from the compose response field, exposing credentials and tokens.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00259 17th percentileScored 2026-11-07
Fix Fixed dockhand (Finsys): 1.0.43

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Finsysdockhandbefore 1.0.431.0.43Patch availableCNA
  • dockhand VendorFinsys Affected before 1.0.43 Fixed in 1.0.43 Patch available CNA

Remediation

Update Finsys Dockhand to version 1.0.43 or later.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA dockhand (Finsys) Fixed in 1.0.43

Timeline

  1. 2026-10-13 Threatist record created from CVE-2026-110255
  2. 2026-10-13 Alias added: GHSA-4qqc-mq6q-rhcc

References

Advisory 1

  • TI-2026-73418 Authentication bypass in Finsys Dockhand via static-asset check CVSS 4.0CRITICAL 10.0
  • TI-2026-84331 Secret disclosure in Dockhand via Git stack webhook CVSS 4.0HIGH 7.1
  • TI-2026-76803 Dockhand Arbitrary File Read via /api/system/files/content CVSS 4.0HIGH 7.1
  • TI-2026-73459 LDAP injection in Dockhand enables username enumeration CVSS 4.0MEDIUM 6.3
  • TI-2026-75363 Unauthenticated command execution in Dockhand container terminal CVSS 3.1CRITICAL 9.6
  • TI-2026-73417 Finsys Dockhand OIDC privilege escalation via missing claim checks CVSS 4.0CRITICAL 9.2
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences