Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Finsys | dockhand | unaffected |
|
No data.
No data.
No data available yet.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
Tue, 13 Oct 2026 19:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Finsys Dockhand before 1.0.45 contains a server-side request forgery vulnerability in the ipCategory() function in src/lib/server/url-safety.ts, which fails to check NAT64, 6to4, and Teredo IPv6 transition ranges. Authenticated attackers can embed loopback, cloud metadata, or private IPv4 addresses in transition IPv6 literals within notification, backup, template, registry, git, or secret provider URLs to reach internal services. | |
| Title | Dockhand before 1.0.45 SSRF via IPv6 Transition Address Bypass in ipCategory | |
| Weaknesses | CWE-918 | |
| References |
| |
| Metrics |
cvssV3_1
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: VulnCheck
Published:
Updated: 2026-10-13T19:05:28.559Z
Reserved: 2026-10-13T18:33:55.548Z
Link: CVE-2026-110254
Vulnrichment
No data.
NVD
Status : Awaiting Analysis
Published: 2026-10-13T19:18:49.697
Modified: 2026-10-13T19:30:29.797
Link: CVE-2026-110254
Redhat
No data.
OpenCVE Enrichment
No data.
-
CWE-918
Server-Side Request Forgery (SSRF)