CVE-2026-110255
Last modified
CVE-2026-110255 is a high-severity vulnerability rated 8.5/10 on the CVSS scale. Finsys Dockhand before 1.0.43 contains a response-disclosing server-side request forgery vulnerability that allows authenticated users to make the server fetch arbitrary URLs by supplying repository URL and stackfile values. Attackers can send stack templates pointing to internal services or cloud metadata endpoints and read the fetched content from the compose response field, exposing credentials and tokens..
Description
Finsys Dockhand before 1.0.43 contains a response-disclosing server-side request forgery vulnerability that allows authenticated users to make the server fetch arbitrary URLs by supplying repository URL and stackfile values. Attackers can send stack templates pointing to internal services or cloud metadata endpoints and read the fetched content from the compose response field, exposing credentials and tokens.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Finsys | dockhand | < 1.0.43 |
References
Timeline
- Published
- Last Modified
- Status
- Awaiting Analysis
Frequently Asked Questions
What is CVE-2026-110255?
How severe is CVE-2026-110255?
How do I fix CVE-2026-110255?
How Strix Helps
- One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-110248Insertion of sensitive information into log files in the git…5.3
- CVE-2026-110249A malicious, compromised, or MITM-controlled Exchange server…
- CVE-2026-11025Insufficient policy enforcement in Navigation in Google Chro…6.5
- CVE-2026-110252The WPeMatico RSS Feed Fetcher plugin for WordPress is vulne…5.4
- CVE-2026-110253The weForms – Easy Drag & Drop Contact Form Builder For Word…5.4
- CVE-2026-110254Finsys Dockhand before 1.0.45 contains a server-side request…4.3
- CVE-2026-110256Finsys Dockhand through 1.0.18 contains an LDAP injection vu…3.7
- CVE-2026-110257OW2 ASM 5.0 before 9.11 contains an excessive memory allocat…5.5
- CVE-2026-110258OW2 ASM 3.0 before 9.11 contains an excessive memory allocat…5.5
- CVE-2026-110259OW2 ASM 3.0 before 9.11 contains an uncontrolled recursion v…5.5
- CVE-2026-11026Inappropriate implementation in Extensions in Google Chrome …6.5
- CVE-2026-110260OW2 ASM 3.0 before 9.11 contains a quadratic memory allocati…5.5
Are you affected by CVE-2026-110255?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST