High severity · published Oct 13, 2026
CVE-2026-110112
Dockhand before 1.0.50 OIDC Privilege Escalation via Missing Token Claim Validation
8.1
CVSS
0.4%
EPSS
No
On KEV
Description
Dockhand before 1.0.50 contains a privilege escalation vulnerability that allows users from another tenant to gain admin access because OIDC iss, aud, nonce and exp claims are not validated. Attackers with admin rights in another tenant of a shared provider like Microsoft Entra ID can recreate the mapped admin group and log in as Dockhand administrators.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 33% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DO
dockhand · Finsys
before 1.0.50 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-110112
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-110112
vendor-advisory
https://github.com/Finsys/dockhand/security/advisories/GHSA-h4vc-h76x-c279
third-party-advisory
https://www.vulncheck.com/advisories/dockhand-before-1.0.50-oidc-privilege-escalation-via-missing-token-claim-validation
More from dockhand
10.0
CVE-2026-110130
Dockhand before 1.0.45 Authentication Bypass via Static-Asset Check
10.0
CVE-2026-53988
Dockhand < 1.0.40 Unauthenticated Webhook Trigger via Git Webhook Endpoints
9.6
CVE-2026-57169
Dockhand: Unauthenticated container exec via WebSocket upgrade
8.5
CVE-2026-110255
Dockhand before 1.0.43 SSRF via /api/templates/compose Endpoint
6.5
CVE-2026-113354
Dockhand before 1.0.46 Arbitrary File Read via /api/system/files/content