Finsys Dockhand EUVD-2026-100466

Exploitation requires an authenticated low-privilege account (CVSS PR:L) on Dockhand and the ability to set at least one outbound URL field - specifically notification, backup, template, registry, git, or secret-provider URLs. The attacker must encode an internal target (loopback, RFC1918 private IPv4, or cloud metadata 169.254.169.254) inside a NAT64, 6to4, or Teredo IPv6 transition literal so that the flawed ipCategory() check in src/lib/server/url-safety.ts fails to classify it as private. Limiting factors: no anonymous/unauthenticated access, the Dockhand instance must have network reachability to the intended internal service, and realistic credential-theft impact additionally depends on the deployment running in a cloud environment with an exposed metadata endpoint. Affected deployments are all versions before 1.0.45.

This is a genuine but moderate-priority issue, not a critical one. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms network-reachable, low-complexity exploitation, but PR:L means the attacker must already hold valid authenticated (low-privilege) access to Dockhand before they can supply a malicious URL - this is the single biggest limiting factor and keeps the base score at 5.3 (Medium). Impact is deliberately scoped low: VC:N/VI:L/VA:N on the vulnerable system with SC:L/SI:L/SA:L on subsequent (internal) systems, reflecting that SSRF yields limited internal access rather than full compromise. No EPSS score was supplied, there is no CISA KEV listing, and no public exploit was referenced, so there is no evidence of active or automated exploitation - this should be treated as an authenticated post-access risk rather than an internet-wide emergency. The main escalation path worth noting is that reaching cloud metadata endpoints could expose instance credentials, which would raise real-world impact above what the base metrics suggest; verify whether affected deployments run in cloud environments with accessible metadata services. A vendor patch exists (1.0.45), making remediation straightforward.

An attacker with a valid low-privilege Dockhand account configures a notification, backup, template, registry, git, or secret-provider URL using an IPv6 transition literal (NAT64, 6to4, or Teredo) that encodes an internal IPv4 target such as 127.0.0.1 or the cloud metadata address 169.254.169.254. Because ipCategory() in url-safety.ts does not classify these transition ranges, the embedded private/loopback address bypasses the SSRF filter and Dockhand issues the request to the internal service. No public exploit code was identified at time of analysis, though the bypass technique is well understood.