CVE-2026-74756 · Other
NO FIX YET · SEE WHAT TO DO
Some docker-compose files shipped by the project publish the Webadmin REST API to the network with no proper authentication configured. An attacker who can reach that port may be able to use the API without credentials.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams that deploy the project's docker-compose files with the Webadmin service reachable from a network they do not control. Deployments that run a version before 3.9.1 and publish the Webadmin port are exposed. Teams that keep the Webadmin port private or are on 3.9.1 or later are likely not affected.
Not affected if port-not-published, private-network, version-3.9.1-or-later
Who cares docker-compose, self-hosted, webadmin
3.9.1 onward sets a random credential by default.3.9.1 or later, which the description says sets a random credential by default on the Webadmin endpoints.Some docker-compose shipped by the project exposes by default Webadmin REST API publically without proper authentication setup. Version 3.9.1 onward sets a random credential by default on unprotected webadmin endpoints to prevent this while retain convenience.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.