CVE-2026-110112

High

Description

Dockhand before 1.0.50 contains a privilege escalation vulnerability that allows users from another tenant to gain admin access because OIDC iss, aud, nonce and exp claims are not validated. Attackers with admin rights in another tenant of a shared provider like Microsoft Entra ID can recreate the mapped admin group and log in as Dockhand administrators.

SeverityHigh

CVSS8.1

Exploit probability—

ProductFinsys Dockhand

PublishedOct 13, 2026

First seenOct 13, 2026

Weakness typeCWE-863Incorrect authorization

How to fix

Update

Finsys dockhand1.0.50 or later

Vendor advisories

github.com/Finsys/dockhand/security/advisories/GHSA-h4vc-h76x-c279

Affected products

Product	Affected versions	Fixed in
Finsys dockhand	v < 1.0.50	1.0.50

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.