Dockhand before 1.0.43 contains a response‑disclosing server‑side request forgery vulnerability in the /api/templates/compose endpoint. Authenticated users can submit arbitrary repository URL and stackfile values, causing the server to fetch any URL. The content returned by the external request is revealed in the compose response, allowing attackers to read internal service responses or cloud metadata. As a result, credentials, tokens, or other sensitive information may be exposed, compromising confidentiality of the environment.

The affected product is Finsys Dockhand. All versions prior to 1.0.43 are vulnerable. Installations relying on older releases must be considered at risk.

The CVSS score of 8.4 indicates a high severity. EPSS is not available, so the current likelihood of exploitation is uncertain, but the fact that it requires authentication reduces the risk to users with credentials. The vulnerability is not listed in the CISA KEV catalog, suggesting no documented exploits to date. Attackers would need to authenticate to the Dockhand instance and send a crafted request; the vulnerable endpoint then retrieves arbitrary URLs and returns their content, enabling data exposure. Because the vulnerability is service‑level, a single compromised account can affect entire deployments.