CVE-2026-110112: Dockhand before 1.0.50 OIDC Privilege Escalation via Missing Token Claim Validation
Dockhand before 1.0.50 contains a privilege escalation vulnerability that allows users from another tenant to gain admin access because OIDC iss, aud, nonce and exp claims are not validated. Attackers with admin rights in another tenant of a shared provider like Microsoft Entra ID can recreate the mapped admin group and log in as Dockhand administrators.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Dockhand deployments before 1.0.50 that use OIDC with a shared identity provider across multiple tenants are exposed. The described cross-tenant attack specifically applies to providers such as Microsoft Entra ID where an attacker can administer another tenant.
What does an attacker need to exploit the vulnerability?
The attacker needs administrative rights in another tenant of the shared OIDC provider. They can recreate the group mapped to Dockhand administrator access and use it to authenticate as a Dockhand administrator.
Does exploitation require an existing Dockhand account or user interaction?
No existing Dockhand privileges or user interaction are described as requirements. The attack is performed through OIDC authentication using claims that Dockhand does not validate.
How can teams determine whether they may be affected?
Check whether the Dockhand version is earlier than 1.0.50 and whether it relies on OIDC from a provider shared across tenants. Also review whether a provider group is mapped to Dockhand administrator access, since the attack recreates that mapped group in another tenant.