High severity · published Oct 13, 2026
CVE-2026-110255
Dockhand before 1.0.43 SSRF via /api/templates/compose Endpoint
8.5
CVSS
0.3%
EPSS
No
On KEV
Description
Finsys Dockhand before 1.0.43 contains a response-disclosing server-side request forgery vulnerability that allows authenticated users to make the server fetch arbitrary URLs by supplying repository URL and stackfile values. Attackers can send stack templates pointing to internal services or cloud metadata endpoints and read the fetched content from the compose response field, exposing credentials and tokens.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 18% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DO
dockhand · Finsys
before 1.0.43 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-110255
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-110255
vendor-advisory
https://github.com/Finsys/dockhand/security/advisories/GHSA-f2mx-74xq-g4p9
third-party-advisory
https://www.vulncheck.com/advisories/dockhand-before-1.0.43-ssrf-via-api-templates-compose-endpoint
More from dockhand
10.0
CVE-2026-110130
Dockhand before 1.0.45 Authentication Bypass via Static-Asset Check
10.0
CVE-2026-53988
Dockhand < 1.0.40 Unauthenticated Webhook Trigger via Git Webhook Endpoints
9.6
CVE-2026-57169
Dockhand: Unauthenticated container exec via WebSocket upgrade
8.1
CVE-2026-110112
Dockhand before 1.0.50 OIDC Privilege Escalation via Missing Token Claim Validation
6.5
CVE-2026-113354
Dockhand before 1.0.46 Arbitrary File Read via /api/system/files/content