What is GHSA-4qqc-mq6q-rhcc?

GHSA-4qqc-mq6q-rhcc is a security advisory published by GitHub Security Advisories with High severity. Finsys Dockhand before 1.0.43 contains a response-disclosing server-side request forgery...

Which CVE IDs does GHSA-4qqc-mq6q-rhcc cover?

GHSA-4qqc-mq6q-rhcc covers the following CVE IDs: CVE-2026-110255. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-4qqc-mq6q-rhcc?

GHSA-4qqc-mq6q-rhcc has a CVSS v3 base score of 8.5, published by GitHub Security Advisories.

GHSA-4qqc-mq6q-rhccHighCVSS 8.5

Finsys Dockhand before 1.0.43 contains a response-disclosing server-side request forgery...

Vendor

GitHub Security Advisories

Published

October 13, 2026

Last Modified

October 13, 2026

🔗 CVE IDs covered (1)

CVE-2026-110255 →

📋 Description

Finsys Dockhand before 1.0.43 contains a response-disclosing server-side request forgery vulnerability that allows authenticated users to make the server fetch arbitrary URLs by supplying repository URL and stackfile values. Attackers can send stack templates pointing to internal services or cloud metadata endpoints and read the fetched content from the compose response field, exposing credentials and tokens.

🔗 References (4)

https://github.com/Finsys/dockhand/security/advisories/GHSA-f2mx-74xq-g4p9
https://nvd.nist.gov/vuln/detail/CVE-2026-110255
https://www.vulncheck.com/advisories/dockhand-before-1.0.43-ssrf-via-api-templates-compose-endpoint
https://github.com/advisories/GHSA-4qqc-mq6q-rhcc