Skip to content
CVE PROGRAM SOURCE RECORD5.3 Medium

CVE-2026-110254

Dockhand before 1.0.45 SSRF via IPv6 Transition Address Bypass in ipCategory

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

Finsys Dockhand before 1.0.45 contains a server-side request forgery vulnerability in the ipCategory() function in src/lib/server/url-safety.ts, which fails to check NAT64, 6to4, and Teredo IPv6 transition ranges. Authenticated attackers can embed loopback, cloud metadata, or private IPv4 addresses in transition IPv6 literals within notification, backup, template, registry, git, or secret provider URLs to reach internal services.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Finsys dockhand

Default version status: unaffected

  • 0 to < 1.0.45affected
  • 1.0.45unaffected
pkg:github/Finsys/dockhand

References