CVE-2026-110255: Dockhand before 1.0.43 SSRF via /api/templates/compose Endpoint
Finsys Dockhand before 1.0.43 contains a response-disclosing server-side request forgery vulnerability that allows authenticated users to make the server fetch arbitrary URLs by supplying repository URL and stackfile values. Attackers can send stack templates pointing to internal services or cloud metadata endpoints and read the fetched content from the compose response field, exposing credentials and tokens.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated Dockhand user can exploit it. The attack can be performed remotely with low complexity and does not require user interaction.
What access does an attacker need to obtain sensitive data?
The attacker needs credentials for an account permitted to call the /api/templates/compose endpoint. They can provide repository URL and stackfile values that cause the server to request internal services or cloud metadata endpoints.
Can the attacker read the response from internal targets?
Yes. The vulnerability is response-disclosing: fetched content is returned in the compose response field, which can expose credentials, tokens, or other data available to the server.
Which versions are affected?
Dockhand versions before 1.0.43 are affected. Updating to version 1.0.43 or later addresses the affected version range described.