---
id: CVE-2026-110255
title: >-
  Finsys Dockhand before 1.0.43 contains a response-disclosing server-side
  request forgery vulnerability that allows authenticated users to make the
  server fetch arbitrary URLs by supplying repository URL and stackfile values
summary: >-
  Finsys Dockhand before 1.0.43 contains a response-disclosing server-side
  request forgery vulnerability that allows authenticated users to make the
  server fetch arbitrary URLs by supplying repository URL and stackfile values.
  Attackers ca…
severity: high
cvss: 8.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N'
cwe:
  - CWE-918
published: '2026-10-13'
updated: '2026-10-13'
sourceUpdated: '2026-10-13T20:17:28.340'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-110255'
references:
  - url: 'https://github.com/Finsys/dockhand/security/advisories/GHSA-f2mx-74xq-g4p9'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/dockhand-before-1.0.43-ssrf-via-api-templates-compose-endpoint
    label: disclosure@vulncheck.com
  - url: 'https://github.com/Finsys/dockhand/security/advisories/GHSA-f2mx-74xq-g4p9'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
ingestedAt: '2026-10-13T19:43:28.945Z'
---

## Overview

Finsys Dockhand before 1.0.43 contains a response-disclosing server-side request forgery vulnerability that allows authenticated users to make the server fetch arbitrary URLs by supplying repository URL and stackfile values. Attackers can send stack templates pointing to internal services or cloud metadata endpoints and read the fetched content from the compose response field, exposing credentials and tokens.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.