What’s Vulnerable › Vulnerabilities

CVE-2026-110254: Dockhand before 1.0.45 SSRF via IPv6 Transition Address Bypass in ipCategory

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-13 · updated 2026-10-14
• Weakness: CWE-918

Description

Finsys Dockhand before 1.0.45 contains a server-side request forgery vulnerability in the ipCategory() function in src/lib/server/url-safety.ts, which fails to check NAT64, 6to4, and Teredo IPv6 transition ranges. Authenticated attackers can embed loopback, cloud metadata, or private IPv4 addresses in transition IPv6 literals within notification, backup, template, registry, git, or secret provider URLs to reach internal services.

Affected products

• Finsys dockhand: before 1.0.45 — fixed in 1.0.45

How to fix

Upgrade to a fixed version: Finsys dockhand 1.0.45. Check the vendor advisory for mitigations.

References

• https://github.com/Finsys/dockhand/security/advisories/GHSA-8rv7-48hx-jfw9
• https://www.vulncheck.com/advisories/dockhand-before-1.0.45-ssrf-via-ipv6-transition-address-bypass-in-ipcategory

Get alerted when CVE-2026-110254 or the next vulnerability affects your stack