CSRF Vulnerability in Dockyard Docker Management App
CVE-2026-39848

6.5MEDIUM

Key Information:

Vendor

10ij

Status
Dockyard
Vendor
CVE Published:
9 April 2026

What is CVE-2026-39848?

Dockyard, a Docker container management application, previously lacked proper CSRF protection for container start and stop operations, which were executed through GET requests. This design flaw allowed malicious actors to exploit a logged-in administrator's session by issuing unauthorized container actions via manipulated browser requests. The vulnerability has been rectified in version 1.1.0.

Affected Version(s)

dockyard < 1.1.0

References

https://github.com/10ij/dockyard/security/advisories/GHSA...
x_refsource_CONFIRM

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.