The ipCategory() function in Dockhand does not filter NAT64, 6to4, or Teredo IPv6 transition addresses. Authenticated users can embed transition‑IPv6 literals that resolve to internal loopback, cloud metadata, or private IPv4 addresses within various URL inputs. The server then performs the request, allowing the attacker to access or enumerate internal services, potentially exfiltrating data or launching further attacks on the internal network.

The vulnerability affects Finsys Dockhand releases prior to version 1.0.45. Any deployment using an older build is at risk. The affected components include the ipCategory() processor used in notification, backup, template, registry, git, or secret provider URL handling.

The CVSS score of 5.3 indicates moderate severity. No EPSS data or KEV listing is available, so exploitation likelihood cannot be precisely quantified. The vulnerability requires authenticated access, so a user with legitimate credentials is needed to craft the malicious URLs. Once the request is sent, the server can reach internal endpoints that might be unreachable from the public internet, giving the attacker a foothold in the internal network.