CVE-2026-110254: Dockhand before 1.0.45 SSRF via IPv6 Transition Address Bypass in ipCategory
Finsys Dockhand before 1.0.45 contains a server-side request forgery vulnerability in the ipCategory() function in src/lib/server/url-safety.ts, which fails to check NAT64, 6to4, and Teredo IPv6 transition ranges. Authenticated attackers can embed loopback, cloud metadata, or private IPv4 addresses in transition IPv6 literals within notification, backup, template, registry, git, or secret provider URLs to reach internal services.
Affected Software
Event History
Frequently Asked Questions
Which users and application features are relevant to exploitation?
An attacker needs an authenticated Dockhand account and the ability to supply URLs through notification, backup, template, registry, git, or secret provider configuration.
What kind of targets could a successful request reach?
The bypass can be used to reach internal services by encoding loopback, cloud metadata, or private IPv4 addresses in NAT64, 6to4, or Teredo IPv6 transition-address literals.