{"id":"CVE-2026-74756","kind":"vulnerability","aliases":["CVE-2026-74756"],"related":[],"title":"Docker Compose files expose Webadmin REST API publicly without authentication","description":"Some docker-compose shipped by the project exposes by default Webadmin REST API publically without proper authentication setup.\nVersion 3.9.1 onward sets a random credential by default on unprotected webadmin endpoints to prevent this while retain convenience.","summary":"Some docker-compose files shipped by the project publish the Webadmin REST API to the network with no proper authentication configured. An attacker who can reach that port may be able to use the API without credentials.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["docker-compose","other","self-hosted","webadmin"],"not_affected_if":["port-not-published","private-network","version-3.9.1-or-later"],"how_to_check":"- Look for the docker-compose file from the project in your deployment and check whether it publishes the Webadmin port.\n- Check the project version in use; the description says `3.9.1` onward sets a random credential by default.\n- Test whether the Webadmin REST API answers without credentials from outside your network.","fix":"- Move to `3.9.1` or later, which the description says sets a random credential by default on the Webadmin endpoints.","status":"open","published_at":"2026-11-06T12:17:21+00:00","first_seen_at":"2026-11-06T12:41:49+00:00","triaged_at":"2026-11-06T12:43:00+00:00","updated_at":"2026-11-06T12:43:00+00:00","category":"other","confidence":0.4,"triage":{"at":"2026-11-06T12:43:00Z","model":"claude-haiku-5-5","output":{"fix":"- Move to `3.9.1` or later, which the description says sets a random credential by default on the Webadmin endpoints.","reach":"internet","title":"Docker Compose files expose Webadmin REST API publicly without authentication","impact":"high","summary":"Some docker-compose files shipped by the project publish the Webadmin REST API to the network with no proper authentication configured. An attacker who can reach that port may be able to use the API without credentials.","audience":"businesses","category":"other","nicknames":[],"who_cares":["docker-compose","self-hosted","webadmin"],"confidence":0.4,"fix_status":"available","needs_auth":"no","worst_case":"unauthenticated attackers may read or change the service through its REST API","analyst_note":"Identify the project and its advisory from the NVD entry; confirm the affected version range and the exact fixed version.","how_to_check":"- Look for the docker-compose file from the project in your deployment and check whether it publishes the Webadmin port.\n- Check the project version in use; the description says `3.9.1` onward sets a random credential by default.\n- Test whether the Webadmin REST API answers without credentials from outside your network.","plain_action":"","needs_analyst":true,"not_affected_if":["version-3.9.1-or-later","port-not-published","private-network"],"who_is_affected":"Teams that deploy the project's docker-compose files with the Webadmin service reachable from a network they do not control. Deployments that run a version before `3.9.1` and publish the Webadmin port are exposed. Teams that keep the Webadmin port private or are on `3.9.1` or later are likely not affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000714,"input_tokens":4194,"output_tokens":590,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-74756':13A,16A '3.9.1':83C 'abl':56B 'api':7A,38B,60B,76C 'attack':48B 'authent':10A,45B,80C 'compos':2A,19B,28B,66C 'configur':46B 'conveni':100C 'credenti':62B,88C 'cve':11A,14A 'default':73C,90C 'docker':1A,18B,27B,65C 'docker-compos':17B,26B,64C 'endpoint':94C 'expos':4A,71C 'file':3A,29B 'host':23B 'may':54B 'network':41B 'onward':84C 'port':53B 'prevent':96C 'project':33B,70C 'proper':44B,79C 'public':8A,77C 'publish':34B 'random':87C 'reach':51B 'rest':6A,37B,75C 'retain':99C 'self':22B 'self-host':21B 'set':85C 'setup':81C 'ship':30B,67C 'unprotect':92C 'use':58B 'version':82C 'webadmin':5A,24B,36B,74C,93C 'without':9A,61B,78C","nicknames":[],"mitigations":[],"who_affected":"Teams that deploy the project's docker-compose files with the Webadmin service reachable from a network they do not control. Deployments that run a version before `3.9.1` and publish the Webadmin port are exposed. Teams that keep the Webadmin port private or are on `3.9.1` or later are likely not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["dockercompose","other","selfhosted","unknown","webadmin"],"campaign_type":null,"search_a":"'-2026':12A,15A '-74756':13A,16A 'api':7A 'authent':10A 'compos':2A 'cve':11A,14A 'docker':1A 'expos':4A 'file':3A 'public':8A 'rest':6A 'webadmin':5A 'without':9A","search_b":"'abl':56B 'api':38B,60B 'attack':48B 'authent':45B 'compos':19B,28B 'configur':46B 'credenti':62B 'docker':18B,27B 'docker-compos':17B,26B 'file':29B 'host':23B 'may':54B 'network':41B 'port':53B 'project':33B 'proper':44B 'publish':34B 'reach':51B 'rest':37B 'self':22B 'self-host':21B 'ship':30B 'use':58B 'webadmin':24B,36B 'without':61B","search_c":"'3.9.1':83C 'api':76C 'authent':80C 'compos':66C 'conveni':100C 'credenti':88C 'default':73C,90C 'docker':65C 'docker-compos':64C 'endpoint':94C 'expos':71C 'onward':84C 'prevent':96C 'project':70C 'proper':79C 'public':77C 'random':87C 'rest':75C 'retain':99C 'set':85C 'setup':81C 'ship':67C 'unprotect':92C 'version':82C 'webadmin':74C,93C 'without':78C","first_public_at":"2026-11-06T12:17:21+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-74756","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74756","severity":null,"published_at":"2026-11-06T12:17:21+00:00","modified_at":"2026-11-06T12:17:21+00:00","first_seen_at":"2026-11-06T12:41:49+00:00","fetched_at":"2026-11-06T12:41:49+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}