CVE-2026-110254

CVSS 5.3 (medium) · published 2026-10-13

Finsys Dockhand before 1.0.45 contains a server-side request forgery vulnerability in the ipCategory() function in src/lib/server/url-safety.ts, which fails to check NAT64, 6to4, and Teredo IPv6 transition ranges. Authenticated attackers can embed loopback, cloud metadata, or private IPv4 addresses in transition IPv6 literals within notification, backup, template, registry, git, or secret provider URLs to reach internal services.

Weakness: CWE-918

Source: NVD CVE-2026-110254

References

• https://github.com/Finsys/dockhand/security/advisories/GHSA-8rv7-48hx-jfw9
• https://www.vulncheck.com/advisories/dockhand-before-1.0.45-ssrf-via-ipv6-transition-address-bypass-in-ipcategory

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.