Vulnerability · Published Oct 13, 2026 · Assigned by VulnCheck

CVE-2026-110254Dockhand before 1.0.45 SSRF via IPv6 Transition Address Bypass in ipCategory

Medium 4.3

In plain English

A medium-severity server-side request forgery in dockhand from Finsys. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.3%top 83.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Finsys Dockhand before 1.0.45 contains a server-side request forgery vulnerability in the ipCategory() function in src/lib/server/url-safety.ts, which fails to check NAT64, 6to4, and Teredo IPv6 transition ranges. Authenticated attackers can embed loopback, cloud metadata, or private IPv4 addresses in transition IPv6 literals within notification, backup, template, registry, git, or secret provider URLs to reach internal services.

Affected products (as reported)

Vendor	Product	Versions
Finsys	dockhand	0 – before 1.0.45

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

References

GitHub Security Advisory (GHSA-8rv7-48hx-jfw9) vendor-advisory
VulnCheck Advisory: Dockhand before 1.0.45 SSRF via IPv6 Transition Address Bypass in ipCategory third-party-advisory