EUVD-2026-100464
GHSA-2v42-28fc-4w3q
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessHold admin in another IdP tenant
-
DeliveryRecreate mapped admin group name
-
ExploitAuthenticate to Dockhand via OIDC
-
ExecutionMissing iss/aud/nonce/exp validation accepts token
-
ImpactGain Dockhand administrator access
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires Dockhand (before 1.0.50) configured to authenticate against a shared, multi-tenant OIDC provider such as Microsoft Entra ID, and requires the attacker to hold administrative rights in a different tenant of that same provider. The attacker must also know and be able to recreate the group name that Dockhand maps to its administrator role. Limiting factors per CVSS 4.0 AC:H/AT:P: this is not exploitable against a single-tenant or isolated IdP, depends on the specific group-mapping configuration, and requires cross-tenant admin control rather than anonymous access - so default single-tenant deployments are not affected. |
| Impact | The input CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N) yields a 9.2 'critical' score, driven by network reach, no required privileges on Dockhand itself, no user interaction, and full confidentiality/integrity/availability impact from obtained admin access. However, the high attack complexity (AC:H) and present attack requirements (AT:P) materially temper real-world risk: exploitation is not opportunistic but conditioned on the target using a shared/multi-tenant OIDC provider and the attacker already holding admin in a separate tenant. No EPSS score is provided in the input, so exploitation probability cannot be quantified here. There is no CISA KEV listing and no public exploit (POC) referenced, so this is 'no public exploit identified at time of analysis' - contrast this with the critical score: high severity does not equal demonstrated exploitation. SSVC-style reading: technical impact is total, but 'automatable' is unlikely given the per-tenant/per-group setup required. Net: a genuinely serious authorization flaw (CWE-863) for organizations running Dockhand against a shared IdP like Entra ID, but currently a patch-promptly priority rather than an emergency, absent any evidence of active or automated exploitation. |
| Exploit ScenarioDerived | An attacker who holds administrative rights in a different tenant of a shared OIDC provider (e.g. Microsoft Entra ID) recreates the group that Dockhand maps to its administrator role, then authenticates to Dockhand via OIDC. Because Dockhand before 1.0.50 does not validate the token's iss, aud, nonce, and exp claims, the cross-tenant token is accepted and the attacker is granted Dockhand admin. No public proof-of-concept is referenced in the available data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Privilege escalation in Dockhand before 1.0.50 allows an attacker who holds administrative rights in a different tenant of a shared OIDC provider such as Microsoft Entra ID to obtain Dockhand administrator access by recreating the group Dockhand maps to its admin role and signing in, because the application fails to validate the OIDC iss, aud, nonce, and exp claims. The issue is rated CVSS 4.0 9.2 (critical) on network reach, no privileges required on Dockhand itself, no user interaction, and full confidentiality, integrity, and availability impact once admin access is obtained, though exploitation requires a shared multi-tenant IdP deployment and knowledge of the mapped group name, so single-tenant or isolated IdP deployments are not affected. No public exploit identified at time of analysis and the vulnerability is not in CISA KEV; a vendor patch is available in 1.0.50.
RemediationAI
Vendor-released patch: upgrade Dockhand to 1.0.50 or later, which adds validation of the OIDC iss, aud, nonce, and exp claims; see GHSA-h4vc-h76x-c279 and https://www.vulncheck.com/advisories/dockhand-before-1.0.50-oidc-privilege-escalation-via-missing-token-claim-validation. Where an immediate upgrade is not possible, compensating controls are deployment-specific: point Dockhand at a single-tenant or dedicated OIDC issuer and application registration so tokens from other tenants cannot be accepted (side effect: migration effort and possible re-enrollment of users), disable OIDC group-to-admin mapping and assign Dockhand administrator rights manually to named accounts (trade effect: loss of automated role provisioning, but admin creation is then auditable and IdP-independent), or, as a last resort, disable OIDC login entirely and fall back to local Dockhand accounts (side effect: SSO loss and separate credential management). Additional hardening includes renaming or removing the IdP group that Dockhand maps to its admin role so the name cannot be recreated cross-tenant, restricting which issuer values reach the application via reverse-proxy or IdP conditional-access policy checks, and alerting on Dockhand admin logins originating from unexpected tenants or applications. For environments that already ran a vulnerable configuration, treat Dockhand admin access as potentially compromised: rotate local admin credentials and any secrets managed by Dockhand, and review audit logs for logins tied to recreated or unexpected groups.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Dockhand acts as an OpenID Connect relying party, accepting ID tokens from an external identity provider and deriving application roles from a group claim. The root cause is CWE-863 (Incorrect Authorization): the token validation routine does not verify the issuer (iss), audience (aud), nonce, or expiration (exp) claims before trusting the token and its group membership. Because a shared multi-tenant provider such as Microsoft Entra ID signs tokens for all tenants with the same key material, a token minted for a different tenant's application is accepted as if it were issued for Dockhand's own registration; an attacker with tenant-admin rights elsewhere in that provider can create a group whose name matches Dockhand's admin-mapped group and then authenticate through it. Missing nonce validation also removes replay protection, and missing exp validation permits the use of expired tokens. The CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N) scores 9.2 critical, with AC:H/AT:P reflecting that the target must be wired to a shared multi-tenant IdP and that cross-tenant administrative control and the correct group name are prerequisites; the assessed CVSS 3.1 view (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) agrees on unauthenticated network reach and full impact within Dockhand while keeping the attack complexity high. Affected code is dockhand 0 through <1.0.50 per the EUVD entry (EUVD-2026-100464), with vendor details in GHSA-h4vc-h76x-c279 and the VulnCheck advisory.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Network OIDC flow (AV:N) with no privileges on Dockhand itself (PR:N), but AC:H because it requires a shared IdP and recreating the mapped admin group; successful attack yields full admin (C/I/A:H).
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
2DescriptionCVE.org
Dockhand before 1.0.50 contains a privilege escalation vulnerability that allows users from another tenant to gain admin access because OIDC iss, aud, nonce and exp claims are not validated. Attackers with admin rights in another tenant of a shared provider like Microsoft Entra ID can recreate the mapped admin group and log in as Dockhand administrators.
Technical POC Analysis
Bug class: CWE-863 Incorrect Authorization.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
Dockhand versions prior to 1.0.50 contain a critical privilege escalation flaw that allows an attacker with administrative access in another tenant of a shared OIDC identity provider to gain full Dockhand administrator rights. Organizations using Dockhand with a shared multi-tenant identity provider such as Microsoft Entra ID are at risk, as a successful exploit could lead to complete compromise of Dockhand's confidentiality, integrity, and availability. Single-tenant or isolated identity provider deployments are not affected.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Exploit-DB