External risk intelligence

Dockhand OIDC Claim Validation Privilege Escalation.

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-110112

Dockhand is a web-based application utilizing OIDC for authentication. As a web application managing user access and administrative functions, it is commonly deployed as an internet-facing or externally reachable service for users to log in, making the authentication and privilege management interface a likely component of the public-facing attack surface.

Privilege Escalation

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability exists in Dockhand related to how it validates security tokens, potentially allowing unauthorized users to gain administrative access within a shared system. This could have implications for user control and data access if the affected technology is in use. The primary concern is to confirm if Dockhand is deployed within the organization and if so, assess the exposure.

Unvalidated security tokens grant admin access.
Critical for leaders to confirm if Dockhand is deployed.
Assess usage and confirm potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by leveraging their administrative access in a separate tenant within a shared provider like Microsoft Entra ID. By recreating a mapped admin group, they can then log in as administrators of Dockhand, bypassing normal authentication. This allows them to escalate privileges and potentially gain full control.

Entry condition: Attacker has admin access in another tenant.
Trigger point: Recreate mapped admin group.
Resulting risk: Tenant privilege escalation to admin.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, attackers with administrative rights in another tenant of a shared provider like Microsoft Entra ID could recreate the mapped admin group and log in as Dockhand administrators, potentially affecting service behavior.

User access and administrative functions.
Unvalidated OIDC claims during authentication.
Unauthorized administrative control of the service.

Operational Fix

Recommended remediation, mitigation, and detection steps

The platform or infrastructure team is likely responsible for addressing this vulnerability in Dockhand, as it impacts core authentication mechanisms. The first actionable step is to identify all instances of Dockhand within the environment, assess their exposure (especially any internet-facing deployments), and confirm their business criticality to prioritize remediation efforts.

Ownership: Platform or Infrastructure team.
Verify first: Identify all Dockhand instances.
Action: Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Dockhand?

Dockhand is a web-based application designed to manage user access and administrative functions. It typically relies on OpenID Connect (OIDC) to handle authentication, allowing users to log in securely through shared identity providers like Microsoft Entra ID.

How does the CVE-2026-110112 weakness work?

This flaw is classified as CWE-863, which concerns improper authorization. It occurs because the application fails to validate critical OpenID Connect token claims, such as issuer, audience, nonce, and expiration. Without these checks, the system cannot verify that a token is intended for its specific environment, allowing users to present potentially illegitimate tokens to gain unauthorized access.

What triggers this privilege escalation?

An attacker must possess administrative privileges in a different tenant within a shared identity provider. By recreating a specifically mapped admin group that the application expects, they can bypass standard authentication checks. Simply being a standard user or an external visitor without those specific administrative rights in a co-tenant does not trigger this vulnerability.

Is my Dockhand instance at risk?

According to Halo Surface Signal, this software is often deployed as an internet-facing service to facilitate remote user logins. If your instance is externally reachable, it is at higher risk because the authentication interface is exposed. Organizations using Dockhand in shared environments where tenants share an identity provider should prioritize evaluating their specific configuration.

What should I do if I run Dockhand?

Start by identifying all instances of Dockhand deployed across your environment to understand your total footprint. Once you have a complete inventory, verify which instances are exposed to the internet and assess their business criticality. Coordinate with your platform or infrastructure team to ensure that only authorized, secure versions are running.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.