All vulnerabilities
CVE-2026-110255GHSA-f2mx-74xq-g4p9

Dockhand before 1.0.43 SSRF via /api/templates/compose Endpoint

Finsys dockhand
Open in ThreatlineRecord JSON
CVSS
8.4High
ExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 13 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.26%Chance of exploitation activity in the next 30 days, higher than 16% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in1.0.43Fixed versionCVE List
Published13 Oct 2026Updated 13 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Finsys Dockhand before 1.0.43 contains a response-disclosing server-side request forgery vulnerability that allows authenticated users to make the server fetch arbitrary URLs by supplying repository URL and stackfile values. Attackers can send stack templates pointing to internal services or cloud metadata endpoints and read the fetched content from the compose response field, exposing credentials and tokens.

Text from CVE List

Affected versions 2

  • dockhandaffected: all versions before 1.0.43CVE List
  • dockhandunaffected: 1.0.43CVE List

References 2