Finsys Dockhand EUVD-2026-100467

Requires a valid authenticated account on the Dockhand instance (CVSS PR:L) with the ability to create or submit stack templates to the API compose endpoint. The attacker must supply attacker-controlled repository URL and/or stackfile values that the server will fetch, and the compose endpoint must return the fetched body in its response field - this response-disclosing behavior is what makes the SSRF directly exploitable for data theft rather than blind. Exploitation is meaningfully amplified when Dockhand runs in a cloud environment with reachable instance-metadata endpoints or sensitive internal services on the server's network. Primary limiting factor: authentication is required (not unauthenticated); no user interaction or special non-default configuration is otherwise indicated. Affected: all versions before 1.0.43.

This is a genuine but conditional priority rather than a drop-everything emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H) scoring 8.4 (High) is internally consistent with the description: a network-reachable, low-complexity, response-disclosing SSRF that requires low-privilege authentication (PR:L) and yields high confidentiality impact on both the vulnerable system (VC:H) and a subsequent system (SC:H) - the latter reflecting access to internal services and cloud metadata beyond Dockhand itself. The standout risk is that this is a *response-disclosing* SSRF reaching cloud metadata endpoints (e.g., 169.254.169.254), which turns it into a direct credential/token theft primitive rather than a blind SSRF. Tempering factors: exploitation requires valid authentication (PR:L), so it is not an unauthenticated internet-facing bug, and there is no EPSS score, no CISA KEV listing, and no public exploit code referenced in the provided data - so there is no public exploit identified at time of analysis and no evidence of active or widespread exploitation. No signals conflict here; the main caveat is simply that exploitation-probability telemetry (EPSS/KEV/POC) is entirely absent, so prioritization rests on impact and ease rather than observed activity.

An authenticated low-privilege user of a Dockhand instance submits a stack template whose repository URL or stackfile value points at an internal address such as the cloud instance metadata endpoint. Dockhand's server fetches that URL and returns the fetched content in the compose response field, letting the attacker read internal service data and harvest cloud credentials or tokens. No public exploit code is referenced, but the low attack complexity (AC:L) means a working request is trivial to craft once authenticated.