---
id: "CVE-2026-74756"
page: "https://infrastack.ai/live/CVE-2026-74756"
kind: "vulnerability"
aliases: ["CVE-2026-74756"]
title: "Docker Compose files expose Webadmin REST API publicly without authentication"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["docker-compose", "other", "self-hosted", "webadmin"]
not_affected_if: ["port-not-published", "private-network", "version-3.9.1-or-later"]
published_at: "2026-11-06T12:17:21+00:00"
first_seen_at: "2026-11-06T12:41:49+00:00"
updated_at: "2026-11-06T12:43:00+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-74756", "first_seen_at": "2026-11-06T12:41:49+00:00"}]
exploit_sources: []
---

# Docker Compose files expose Webadmin REST API publicly without authentication

Link for people: https://infrastack.ai/live/CVE-2026-74756 (this .md is for agents)

Some docker-compose files shipped by the project publish the Webadmin REST API to the network with no proper authentication configured. An attacker who can reach that port may be able to use the API without credentials.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Look for the docker-compose file from the project in your deployment and check whether it publishes the Webadmin port.
- Check the project version in use; the description says `3.9.1` onward sets a random credential by default.
- Test whether the Webadmin REST API answers without credentials from outside your network.

## Fix

- Move to `3.9.1` or later, which the description says sets a random credential by default on the Webadmin endpoints.

## Timeline

- 2026-11-06T12:41:49+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-74756

## From the sources

Some docker-compose shipped by the project exposes by default Webadmin REST API publically without proper authentication setup.
Version 3.9.1 onward sets a random credential by default on unprotected webadmin endpoints to prevent this while retain convenience.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_