Medium severity · published Oct 13, 2026
CVE-2026-110254
Dockhand before 1.0.45 SSRF via IPv6 Transition Address Bypass in ipCategory
4.3
CVSS
0.3%
EPSS
No
On KEV
Description
Finsys Dockhand before 1.0.45 contains a server-side request forgery vulnerability in the ipCategory() function in src/lib/server/url-safety.ts, which fails to check NAT64, 6to4, and Teredo IPv6 transition ranges. Authenticated attackers can embed loopback, cloud metadata, or private IPv4 addresses in transition IPv6 literals within notification, backup, template, registry, git, or secret provider URLs to reach internal services.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 17% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DO
dockhand · Finsys
before 1.0.45 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-110254
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-110254
vendor-advisory
https://github.com/Finsys/dockhand/security/advisories/GHSA-8rv7-48hx-jfw9
third-party-advisory
https://www.vulncheck.com/advisories/dockhand-before-1.0.45-ssrf-via-ipv6-transition-address-bypass-in-ipcategory
More from dockhand
10.0
CVE-2026-110130
Dockhand before 1.0.45 Authentication Bypass via Static-Asset Check
10.0
CVE-2026-53988
Dockhand < 1.0.40 Unauthenticated Webhook Trigger via Git Webhook Endpoints
9.6
CVE-2026-57169
Dockhand: Unauthenticated container exec via WebSocket upgrade
8.5
CVE-2026-110255
Dockhand before 1.0.43 SSRF via /api/templates/compose Endpoint
8.1
CVE-2026-110112
Dockhand before 1.0.50 OIDC Privilege Escalation via Missing Token Claim Validation