CVE-2026-110254

Awaiting Analysis Awaiting Analysis - Queue

Server-Side Request Forgery in Finsys Dockhand

Publication date: 2026-10-13

Last updated on: 2026-10-14

Assigner: VulnCheck

Description

Finsys Dockhand before 1.0.45 contains a server-side request forgery vulnerability in the ipCategory() function in src/lib/server/url-safety.ts, which fails to check NAT64, 6to4, and Teredo IPv6 transition ranges. Authenticated attackers can embed loopback, cloud metadata, or private IPv4 addresses in transition IPv6 literals within notification, backup, template, registry, git, or secret provider URLs to reach internal services.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-14

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110254

EUVD

EUVD-2026-100466

Affected Vendors & Products

Vendor	Product	Version / Range
Finsys	dockhand	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

CVE-2026-110254 is a Server-Side Request Forgery (SSRF) vulnerability in Finsys Dockhand before version 1.0.45. The flaw exists in the ipCategory() function which fails to check IPv6 transition address ranges like NAT64, 6to4, and Teredo. Attackers can embed loopback, cloud metadata, or private IPv4 addresses within these IPv6 literals in URLs for services such as notifications, backups, templates, registries, Git, or secret providers to bypass security checks and access internal services.

Detection Guidance

To detect this SSRF vulnerability, inspect Dockhand logs for suspicious URL requests containing IPv6 transition addresses like NAT64 (64:ff9b::/96), 6to4 (2002::/16), or Teredo (2001::/32) literals. Check for encoded IPv4 addresses within these ranges, such as 64:ff9b::7f00:1 (127.0.0.1). Monitor network traffic for outbound requests to internal services from Dockhand processes.

Impact Analysis

This vulnerability allows authenticated attackers to bypass IP-based security controls and access internal services such as loopback services, cloud metadata endpoints, or private IP ranges. This could lead to unauthorized access, data exfiltration, or further exploitation of internal systems depending on the services exposed.

Compliance Impact

This SSRF vulnerability could lead to unauthorized access to internal services, potentially exposing sensitive data. For GDPR, this may violate Article 32 (security of processing) if personal data is accessed. For HIPAA, it risks breaching protected health information (PHI) if internal systems are compromised.

Mitigation Strategies

Immediately update Dockhand to version 1.0.45 or later to patch the SSRF flaw. If an update is not immediately available, implement network-level controls to block outbound requests from Dockhand to internal IP ranges, including loopback and cloud metadata endpoints. Review and restrict URL configurations for notification, backup, and registry services to prevent IPv6 transition address abuse.

Hi! I’m here to help you understand CVE-2026-110254. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70