CVE-2026-110130GHSA-r3mg-r5vm-3v6w
Dockhand before 1.0.45 Authentication Bypass via Static-Asset Check
Finsys dockhand
CVSS
10.0CriticalExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 14 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.56%Chance of exploitation activity in the next 30 days, higher than 45% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 1.0.45dockhandCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Dockhand before 1.0.45 contains an authentication bypass in which the global auth hook skips authentication for any path ending in a static-asset extension such as .js, including /api/* routes, and the user-mutation handlers fail open for unauthenticated callers. Unauthenticated remote attackers can send a PUT request to /api/users/<id>.js to reset the admin's or any user's password and take over the account.
Text from CVE List
Affected versions 2
- dockhandaffected: all versions before 1.0.45CVE List
- dockhandunaffected: 1.0.45CVE List