{"id":"CVE-2026-74756","published":"2026-11-06T12:17:21.657","lastModified":"2026-11-10T21:12:59.753","description":"Some docker-compose shipped by the project exposes by default Webadmin REST API publically without proper authentication setup.\nVersion 3.9.1 onward sets a random credential by default on unprotected webadmin endpoints to prevent this while retain convenience.","cvssScore":9.1,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cwes":["CWE-1188"],"vendors":[],"products":[],"references":[{"url":"https://lists.apache.org/thread.html/5zhn007mc3jz691zhb2687ow2n7f0zp0","tags":[]},{"url":"http://www.openwall.com/lists/oss-security/2026/11/06/15","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"Docker Compose configurations shipped with versions prior to 3.9.1 expose the Webadmin REST API publicly without authentication by default, allowing unauthenticated remote access to sensitive administrative functions. This violates secure configuration principles and enables unauthorized actors to interact with critical system interfaces.","exploitability":"Exploitation is trivial for any remote attacker with network access to the exposed Webadmin endpoint; no authentication or user interaction is required.","blast_radius":"Successful exploitation could lead to full compromise of administrative capabilities, including configuration changes, data exfiltration via API abuse, and potential lateral movement within managed infrastructure.","remediation":"Upgrade to version 3.9.1 or later, which enforces random credential generation on unprotected Webadmin endpoints by default.","detection":"Defenders should monitor for unauthenticated HTTP requests (e.g., GET/POST without Authorization header) to the Webadmin REST API endpoint (typically /api/admin or similar path) from external or unexpected source IPs; repeated failed or successful requests to admin paths without prior authentication may indicate exploitation attempts.","tags":["exposed-api","auth-bypass","docker-compose","webadmin","cwe-1188"],"model":"garnet-coder","analyzedAt":"2026-11-11T09:57:51.150Z"}}