PT-2026-138004

CVE-2026-74756

·

Published

2026-11-06

·

Updated

2026-11-06

Description by

CVSS 3.1
9.1
Critical
MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Some docker-compose shipped by the project exposes by default Webadmin REST API publically without proper authentication setup. Version 3.9.1 onward sets a random credential by default on unprotected webadmin endpoints to prevent this while retain convenience.
Exploitability
Fix
Researchers
Vendors
Affected products
Weakness enumeration
CWE-1188: Initialization of a Resource with an Insecure Default
Related identifiers
CVE-2026-74756
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com