CVE-2026-110254

Dockhand before 1.0.45 SSRF via IPv6 Transition Address Bypass in ipCategory

State: Published
Severity: 5.3 Medium
Published: Oct 13, 2026
Updated: Oct 14, 2026
Reserved: Oct 13, 2026

Description

Finsys Dockhand before 1.0.45 contains a server-side request forgery vulnerability in the ipCategory() function in src/lib/server/url-safety.ts, which fails to check NAT64, 6to4, and Teredo IPv6 transition ranges. Authenticated attackers can embed loopback, cloud metadata, or private IPv4 addresses in transition IPv6 literals within notification, backup, template, registry, git, or secret provider URLs to reach internal services.

Scores

CVSS	Score	Vector	Source
4.0	5.3 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L	VulnCheck
3.1	4.3 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N	VulnCheck

Weaknesses

CWE-918 Server-Side Request Forgery (SSRF)

Affected Products

Product	Versions
dockhandFinsys	before 1.0.45Affected 1.0.45Not affected

References

GitHub Security Advisory (GHSA-8rv7-48hx-jfw9)vendor-advisory
VulnCheck Advisory: Dockhand before 1.0.45 SSRF via IPv6 Transition Address Bypass in ipCategorythird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.