Vulnerabilidades do Finsys Dockhand

🔔 Criar alerta RSS Verificador de versão

CVEs publicadas que afetam Finsys Dockhand: 5 registro(s), com versões afetadas e correções.

CVE-2026-110256 Baixa · 3.7 CWE-90 13/10/2026

Dockhand before 1.0.19 Username Enumeration via LDAP Injection in tryLdapAuth

Finsys Dockhand through 1.0.18 contains an LDAP injection vulnerability in the tryLdapAuth function in src/lib/server/auth.ts, which inserts the login username into the LDAP search filter without escaping wildcard characters. Unauthenticated attackers can submit incremental wildcard patterns such as 'a*' to /api/auth/login and measure response timing to enumerate valid LDAP usernames while evading per-username rate limiting.

CVE-2026-110255 Alta · 8.5 CWE-918 13/10/2026

Dockhand before 1.0.43 SSRF via /api/templates/compose Endpoint

Finsys Dockhand before 1.0.43 contains a response-disclosing server-side request forgery vulnerability that allows authenticated users to make the server fetch arbitrary URLs by supplying repository URL and stackfile values. Attackers can send stack templates pointing to internal services or cloud metadata endpoints and read the fetched content from the compose response field, exposing credentials and tokens.

CVE-2026-110254 Média · 4.3 CWE-918 13/10/2026

Dockhand before 1.0.45 SSRF via IPv6 Transition Address Bypass in ipCategory

Finsys Dockhand before 1.0.45 contains a server-side request forgery vulnerability in the ipCategory() function in src/lib/server/url-safety.ts, which fails to check NAT64, 6to4, and Teredo IPv6 transition ranges. Authenticated attackers can embed loopback, cloud metadata, or private IPv4 addresses in transition IPv6 literals within notification, backup, template, registry, git, or secret provider URLs to reach internal services.

CVE-2026-110130 Crítica · 10.0 CWE-288 13/10/2026

Dockhand before 1.0.45 Authentication Bypass via Static-Asset Check

Dockhand before 1.0.45 contains an authentication bypass in which the global auth hook skips authentication for any path ending in a static-asset extension such as .js, including /api/* routes, and the user-mutation handlers fail open for unauthenticated callers. Unauthenticated remote attackers can send a PUT request to /api/users/<id>.js to reset the admin's or any user's password and take over the account.

CVE-2026-110112 Alta · 8.1 CWE-863 13/10/2026

Dockhand before 1.0.50 OIDC Privilege Escalation via Missing Token Claim Validation

Dockhand before 1.0.50 contains a privilege escalation vulnerability that allows users from another tenant to gain admin access because OIDC iss, aud, nonce and exp claims are not validated. Attackers with admin rights in another tenant of a shared provider like Microsoft Entra ID can recreate the mapped admin group and log in as Dockhand administrators.