CVE-2026-110256— Dockhand before 1.0.19 Username Enumeration via LDAP Injection in tryLdapAuth
Quick assessment
Affected
Finsys dockhand
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Finsys Dockhand 1.0.18 及更早版本中存在一个 LDAP 注入漏洞，该漏洞位于 文件中的 函数内。该函数在将登录用户名插入 LDAP 搜索过滤器之前，未对通配符字符进行转义处理。未经验证身份的攻击者可以向 接口提交递增的通配符模式（例如 ），并通过测量响应时间来枚举有效的 LDAP 用户名，同时规避按用户名设置的速率限制策略。
Possible ATT&CK Techniques 3 AI
T1592 · Gather Victim Host Information T1110 · Brute Force T1590 · Gather Victim Network Information
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-110256
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Dockhand before 1.0.19 Username Enumeration via LDAP Injection in tryLdapAuth
Source: CVE Program / CVE List V5
Vulnerability Description
Finsys Dockhand through 1.0.18 contains an LDAP injection vulnerability in the tryLdapAuth function in src/lib/server/auth.ts, which inserts the login username into the LDAP search filter without escaping wildcard characters. Unauthenticated attackers can submit incremental wildcard patterns such as 'a*' to /api/auth/login and measure response timing to enumerate valid LDAP usernames while evading per-username rate limiting.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
LDAP查询中使用的特殊元素转义处理不恰当(LDAP注入)
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-110256
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-110256
请登录查看更多情报信息。
Other References for CVE-2026-110256 (2)
Same Patch Batch · Finsys · 2026-10-13 · 5 CVEs total
| CVE-2026-110130 | 10.0 CRITICAL | Dockhand before 1.0.45 Authentication Bypass via Static-Asset Check |
| CVE-2026-110255 | 8.5 HIGH | Dockhand before 1.0.43 SSRF via /api/templates/compose Endpoint |
| CVE-2026-110112 | 8.1 HIGH | Dockhand before 1.0.50 OIDC Privilege Escalation via Missing Token Claim Validation |
| CVE-2026-110254 | 4.3 MEDIUM | Dockhand before 1.0.45 SSRF via IPv6 Transition Address Bypass in ipCategory |
IV. Related Vulnerabilities
Same product: dockhand
-
CVE-2026-110255
Dockhand before 1.0.43 SSRF via /api/templates/compose Endpo -
CVE-2026-110254
Dockhand before 1.0.45 SSRF via IPv6 Transition Address Bypa -
CVE-2026-110130
Dockhand before 1.0.45 Authentication Bypass via Static-Asse -
CVE-2026-110112
Dockhand before 1.0.50 OIDC Privilege Escalation via Missing -
CVE-2026-53988
Dockhand < 1.0.40 Unauthenticated Webhook Trigger via Git We
Same vendor: Finsys
-
CVE-2026-110255
Dockhand before 1.0.43 SSRF via /api/templates/compose Endpo -
CVE-2026-110254
Dockhand before 1.0.45 SSRF via IPv6 Transition Address Bypa -
CVE-2026-110130
Dockhand before 1.0.45 Authentication Bypass via Static-Asse -
CVE-2026-110112
Dockhand before 1.0.50 OIDC Privilege Escalation via Missing -
CVE-2026-53988
Dockhand < 1.0.40 Unauthenticated Webhook Trigger via Git We
Same weakness: CWE-90
-
CVE-2026-93635
Zimbra Collaboration Suite LDAP Filter Injection via Unescap -
CVE-2026-89071
MOVEit Transfer LDAP injection in certificate-based authenti -
CVE-2026-10759
BUG-000171040 Portal for ArcGIS has a security vulnerability -
CVE-2025-71431
Frappe before 15.86.0 LDAP Injection via Unsanitized Endpoin -
CVE-2026-109357
LibreNMS before 26.9.0 LDAP Filter Injection Authentication
V. Comments for CVE-2026-110256
No comments yet