CVE-2026-110256
LowCVSS 3.7Summary
Finsys Dockhand through 1.0.18 contains an LDAP injection vulnerability in the tryLdapAuth function in src/lib/server/auth.ts, which inserts the login username into the LDAP search filter without escaping wildcard characters. An unauthenticated attacker can submit incremental wildcard patterns such as 'a*' to /api/auth/login and measure response timing to enumerate valid LDAP usernames while evading per-username rate limiting.
Risk Assessment
An attacker can enumerate valid LDAP usernames, facilitating further attacks such as password brute force or phishing. The risk affects Finsys Dockhand deployments through version 1.0.18 with LDAP authentication.
Recommendation
Update Finsys Dockhand to a version later than 1.0.18 if available, or apply a fix that escapes wildcard characters in LDAP filters. Until patching, consider restricting access to /api/auth/login and monitoring for unusual login patterns.
Other vulnerabilities in Finsys Dockhand
See all- CVE-2026-110255High
Finsys Dockhand before 1.0.43 contains a response-disclosing server-side request forgery vulnerability that allows authenticated users to make the server fetch arbitrary URLs by supplying repository URL and stackfile values. Attackers can send stack templates pointing to internal services or cloud metadata endpoints and read the fetched content from the compose response field, exposing credentials and tokens.
- CVE-2026-110254Medium
Finsys Dockhand before 1.0.45 contains a server-side request forgery vulnerability in the ipCategory() function in src/lib/server/url-safety.ts, which fails to check NAT64, 6to4, and Teredo IPv6 transition ranges. Authenticated attackers can embed loopback, cloud metadata, or private IPv4 addresses in transition IPv6 literals within notification, backup, template, registry, git, or secret provider URLs to reach internal services.
Original NVD description (English source)
Finsys Dockhand through 1.0.18 contains an LDAP injection vulnerability in the tryLdapAuth function in src/lib/server/auth.ts, which inserts the login username into the LDAP search filter without escaping wildcard characters. Unauthenticated attackers can submit incremental wildcard patterns such as 'a*' to /api/auth/login and measure response timing to enumerate valid LDAP usernames while evading per-username rate limiting.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS