What’s Vulnerable › Vulnerabilities

CVE-2026-110112: Dockhand before 1.0.50 OIDC Privilege Escalation via Missing Token Claim Validation

• Severity: high (CVSS 8.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-13 · updated 2026-10-17
• Weakness: CWE-863

Description

Dockhand before 1.0.50 contains a privilege escalation vulnerability that allows users from another tenant to gain admin access because OIDC iss, aud, nonce and exp claims are not validated. Attackers with admin rights in another tenant of a shared provider like Microsoft Entra ID can recreate the mapped admin group and log in as Dockhand administrators.

Affected products

• Finsys dockhand: before 1.0.50 — fixed in 1.0.50

How to fix

Upgrade to a fixed version: Finsys dockhand 1.0.50. Check the vendor advisory for mitigations.

References

• https://github.com/Finsys/dockhand/security/advisories/GHSA-h4vc-h76x-c279
• https://www.vulncheck.com/advisories/dockhand-before-1.0.50-oidc-privilege-escalation-via-missing-token-claim-validation

Get alerted when CVE-2026-110112 or the next vulnerability affects your stack