Vulnerability DatabaseCVE-2026-110112
Mend.io Vulnerability Database
The largest open source vulnerability database
What is a Vulnerability ID?
New vulnerability? Tell us about it!
CVE-2026-110112
Published:October 13, 2026
Updated:October 19, 2026
Dockhand before 1.0.50 contains a privilege escalation vulnerability that allows users from another tenant to gain admin access because OIDC iss, aud, nonce and exp claims are not validated. Attackers with admin rights in another tenant of a shared provider like Microsoft Entra ID can recreate the mapped admin group and log in as Dockhand administrators.
Affected Packages
https://github.com/Finsys/dockhand.git (GITHUB):
Affected version(s) >=v1.0.2 <v1.0.50
Fix Suggestion:
Update to version v1.0.50
Related Resources (5)
https://www.vulncheck.com/advisories/dockhand-before-1.0.50-oidc-privilege-escalation-via-missing-token-claim-validation
https://nvd.nist.gov/vuln/detail/CVE-2026-110112
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110112.json
https://github.com/Finsys/dockhand
https://github.com/Finsys/dockhand/security/advisories/GHSA-h4vc-h76x-c279
Do you need more information?
Contact Us
CVSS v4
Base Score:
9.2
Attack Vector
NETWORK
Attack Complexity
HIGH
Attack Requirements
PRESENT
Privileges Required
NONE
User Interaction
NONE
Vulnerable System Confidentiality
HIGH
Vulnerable System Integrity
HIGH
Vulnerable System Availability
HIGH
Subsequent System Confidentiality
NONE
Subsequent System Integrity
NONE
Subsequent System Availability
NONE
CVSS v3
Base Score:
8.1
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH
Weakness Type (CWE)
Incorrect Authorization
CWE-863
EPSS
Base Score:
0.39