WhatBrokeToday
Today's Trends
criticalInvestigatingDockerv3.9.1+

Docker compose 3.9.1+ Exposes Webadmin REST API Without Authentication

  1. Investigating(current)
  2. Trending(upcoming)
  3. Workaround available(upcoming)
  4. Resolved(upcoming)

Executive summary

A critical vulnerability (CVE-2026-74756) has been identified in docker-compose versions 3.9.1 and above, exposing the Webadmin REST API publicly without proper authentication setup.

No verified workaround yet

None of the linked reports describe a mitigation. Follow this incident to hear when one appears.

Official fix
Technical root cause

The vulnerability arises from default random credentials being set on unprotected webadmin endpoints by docker-compose version 3.9.1 onward to prevent exposure of the publically exposed Webadmin REST API.

Evidence

1 report · 1 CVEShow
  1. [1]
    CVE First report
    Some docker-compose shipped by the project: CVE-2026-74756 (Critical)(opens security advisory in a new tab)

    Critical severity. Some docker-compose shipped by the project exposes by default Webadmin REST API publically without proper authentication setup. Version 3.9.1 onward sets a random credential by default on unprotected webadmin endpoints to prevent this while retain convenience.

    by Tenable 0upvotes 0comments

Timeline

  1. First report on security advisory

    Some docker-compose shipped by the project: CVE-2026-74756 (Critical)

    Source