Threats affecting pkg:github/dockhand

CVE-2026-113354 is an arbitrary file read vulnerability in Finsys dockhand versions prior to 1.0.46. It allows non-admin users with the stacks:edit permission to read arbitrary files via the /api/system/files/content endpoint by supplying absolute file paths. Sensitive files such as /etc/shadow, /etc/passwd, .git/config, and SSH keys within the Dockhand container can be accessed. The vulnerability is fixed in version 1.0.46.

Finsys Dockhand versions prior to 1.0.19 contain an LDAP injection vulnerability in the tryLdapAuth function. This flaw allows unauthenticated attackers to submit crafted wildcard patterns in login requests to enumerate valid LDAP usernames by measuring response timing. The vulnerability arises because the username input is inserted into the LDAP search filter without proper escaping of special characters. A fix is available in version 1.0.19.

CVE-2026-110255 is a server-side request forgery (SSRF) vulnerability in Finsys Dockhand versions before 1.0.43. Authenticated users can exploit this flaw by supplying repository URL and stackfile values that cause the server to fetch arbitrary URLs. This can lead to exposure of sensitive internal service data or cloud metadata endpoints, including credentials and tokens, via the compose response field.

CVE-2026-110254 is a server-side request forgery (SSRF) vulnerability in Finsys Dockhand versions before 1.0.45. The flaw exists in the ipCategory() function, which does not properly validate certain IPv6 transition ranges such as NAT64, 6to4, and Teredo. Authenticated attackers can exploit this by embedding loopback, cloud metadata, or private IPv4 addresses within IPv6 literals in various URL parameters, potentially allowing internal service access.

Dockhand versions before 1.0.45 have an authentication bypass vulnerability where requests to paths ending with static-asset extensions like .js bypass global authentication checks. This flaw allows unauthenticated remote attackers to send specially crafted PUT requests to endpoints such as /api/users/<id>.js to reset passwords of any user, including administrators, enabling account takeover.

Dockhand versions before 1.0.50 have a critical privilege escalation vulnerability due to improper validation of OIDC claims (iss, aud, nonce, exp). This flaw allows users from other tenants in a shared identity provider environment to gain admin access by recreating the mapped admin group and logging in as administrators.

Dockhand versions before 1.0.40 have an authentication bypass vulnerability in their git webhook endpoints. This flaw allows unauthenticated remote attackers to trigger arbitrary stack redeployments by exploiting a null webhook secret guard condition. Attackers can enumerate sequential stack IDs and send unsigned webhook requests to force git clone and docker compose operations. This can lead to denial of service or, if combined with write access to the tracked git branch, container escape and full host compromise via attacker-controlled docker-compose.yml files with privileged bind mounts.

Dockhand versions before 1.0.36 have an open redirect vulnerability in the OIDC initiation endpoint. This flaw allows unauthenticated attackers to redirect authenticated users to malicious sites by manipulating an unvalidated redirect query parameter. Exploitation can lead to capturing authorization codes via the Referer header and enable credential phishing attacks after legitimate user logins. The issue is fixed in version 1.0.36.