Dockhand: Privilege escalation via missing OIDC token claim validation
Summary
Dockhand before 1.0.50 does not validate the iss, aud, nonce and exp claims of OIDC tokens. On a shared multi-tenant identity provider such as Microsoft Entra ID, a user with admin rights in another tenant can recreate the mapped admin group and sign in as a Dockhand administrator. The attacker needs no prior access to Dockhand, and the issue is rated critical by the CNA (CVSS v4.0 9.2) and high by the vendor (CVSS v3.1 8.1).
Affected
- Dockhand 1.0.49 and earlier (all versions before 1.0.50)
- Only installations using OIDC/SSO login are affected by this issue
Fixed in
- Upgrade to Dockhand 1.0.50 or later; the current release is reported as 1.0.55 (verify on the vendor's release page)
Workaround
- No vendor workaround is documented.
- Restrict OIDC logins to your own tenant or application and reject tokens from other tenants.
- Map admin roles to immutable identifiers (for example Entra object IDs) instead of group names.
- Do not expose the Dockhand interface to the internet until it is upgraded.
Exploitation
- Exploited in the wild: no evidence found.
- Public proof of concept: unknown.
- CISA SSVC: exploitation none, not automatable, total technical impact.
- EPSS: 0.00391 (low predicted exploitation probability).
Our recommendation
- Upgrade Dockhand to 1.0.50 or later, preferably the current release.
- Before upgrading, check which identity provider and tenant model are in use.
- Review the membership of the admin group and remove unneeded accounts.
- Check whether the Dockhand interface is reachable from the internet and restrict access.
- Monitor logins to Dockhand for unexpected administrator sessions.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-h4vc-h76x-c279 github.com
- VulnCheck advisory www.vulncheck.com
- OSV record CVE-2026-110112 osv.dev
- Vulners NVD record vulners.com
- ThreatInt CVE record cve.threatint.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 04:38.
Original description (NVD)
Dockhand before 1.0.50 contains a privilege escalation vulnerability that allows users from another tenant to gain admin access because OIDC iss, aud, nonce and exp claims are not validated. Attackers with admin rights in another tenant of a shared provider like Microsoft Entra ID can recreate the mapped admin group and log in as Dockhand administrators.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.