CVE-2026-110254: dockhand 0 to before 1.0.45

Affected technology

dockhand · 0 to before 1.0.45
Finsys

Description’s affected range: before 1.0.45

Component: Not specified by the source
Function: in

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

Authenticated attackers can embed loopback, cloud metadata, or private IPv4 addresses in transition IPv6 literals within notification, backup, template, registry, git, or secret provider URLs to reach internal services. Vendor/CNA’s CVSS 4.0 assessment (base score 5.3/10) rates confidentiality and availability impact as none; integrity impact as low.