CVE-2026-110254: Finsys Dockhand SSRF via IPv6 transition address bypass

CVE-2026-110254 · Severity: medium · CVSS 4.3 · Published 2026-10-13

Dockhand is a container management platform used by organizations to manage deployments and integrations. The vulnerability allows authenticated users to bypass security checks that prevent requests to internal services, potentially exposing metadata endpoints, loopback services, or private network resources. An attacker with user access could craft specially formatted IPv6 addresses to reach restricted internal services that should not be accessible.

Technologies: Finsys Dockhand. Vendors: Finsys.

Quick answers

Is CVE-2026-110254 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-110254 being exploited in the wild.
How severe is CVE-2026-110254?
Medium severity, with a CVSS score of 4.3, published 13 October 2026.
Which products and versions are affected?
Finsys Dockhand before 1.0.45.
Is there a fix for CVE-2026-110254?
Yes: fixed in 1.0.45. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-110254 attacked?
It is attacked over the network.
Am I affected by CVE-2026-110254?
Check whether you run Finsys Dockhand at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: 1.0.45

Technical details

The ipCategory() function in src/lib/server/url-safety.ts fails to extract and validate embedded IPv4 addresses from IPv6 transition address formats (NAT64 WKP 64:ff9b::/96, NAT64 local 64:ff9b:1::/48, 6to4 2002::/16, and Teredo 2001:0000::/32). Authenticated attackers can encode blocked addresses such as 127.0.0.1 or 169.254.169.254 within these transition IPv6 literals to bypass SSRF guards that protect notification endpoints, webhook URLs, backup destinations, template URLs, registry URLs, git repository URLs, and secret provider URLs. The fix requires adding transition address range detection to extract the embedded IPv4 and validate it against existing private/loopback/metadata filters.

Affected products

  • Finsys Dockhand before 1.0.45

Timeline

  • 2026-08-27: disclosed
  • 2026-10-13: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.