External risk intelligence

Docker Compose Webadmin API Default Public Exposure Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-74756

The vulnerability involves a Webadmin REST API that is exposed publicly by default in the provided deployment configuration. Since this service is designed for administrative access and is exposed to the public internet by default, it meets the criteria for a service that is public-facing by design in common deployment patterns.

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A security vulnerability has been identified where a Webadmin REST API, shipped with certain project deployments, may be publicly accessible without proper authentication. While a recent update introduces default random credentials to mitigate this, the underlying exposure highlights a potential risk for unauthorized access to administrative functions. The main concern is confirming relevance and exposure.

Public API access without passwords.
Critical administrative functions at risk.
Verify if exposed, then address access.

Attack Path

How an attacker could exploit the issue

Attackers can reach a Webadmin REST API that is publicly exposed by default in certain Docker Compose configurations. This allows unauthenticated access to administrative functions, potentially leading to a compromise of the system.

Unauthenticated network access is required.
Accessing the public Webadmin REST API triggers the vulnerability.
Risks include unauthorized data access and modification.

Live Threat

Current exploitation, exposure, and threat context

When the Webadmin REST API is exposed publicly by default, attackers could potentially access and manipulate system configurations and sensitive information without authentication. This could occur in deployments where the default docker-compose configurations are used without modifications to restrict access.

System configurations and sensitive data.
Unauthenticated network access.
Unauthorized administrative control.

Operational Fix

Recommended remediation, mitigation, and detection steps

The exposure of the Webadmin REST API by default in docker-compose deployments makes this a critical issue for teams managing containerized applications. Application owners or platform teams responsible for these deployments must first identify all instances of the affected docker-compose configurations, verify their exposure and business criticality, and then coordinate remediation efforts with the security team to mitigate the risk of unauthorized access and data compromise.

Identify and locate affected deployments.
Confirm reachability and business criticality.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the project software associated with CVE-2026-74756?

This software provides a containerized service that includes a Webadmin REST API, typically deployed using Docker Compose templates. It is designed to help administrators manage system configurations and monitor application functions through a web interface.

How should I understand the vulnerability in CVE-2026-74756?

This issue is classified as CWE-1188, which involves the use of insecure default configurations. Specifically, the software's deployment templates were set to expose administrative endpoints publicly without requiring a password, allowing anyone with network access to interact with critical management tools.

What triggers this security vulnerability?

The flaw is triggered by the presence of the default docker-compose configuration that leaves the Webadmin REST API reachable over the network. It is not triggered if the service is deployed within a protected, non-public network segment or if custom authentication controls were added before initial deployment.

How does Halo Surface Signal assess this risk?

Halo Surface Signal flags this as a high-priority concern because the Webadmin REST API is exposed publicly by default. Because the service is intended for administrative control, its availability on the public internet creates a direct path for unauthorized users to reach sensitive system functions.

Do I need to update my deployment to address this?

Yes, you should review your current Docker Compose files to see if they expose the Webadmin API. If you are using version 3.9.1 or later, the software now enforces random default credentials to secure these endpoints, so upgrading is a primary step to ensure your administrative interface is no longer open to the public.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.