Webadmin REST API Vulnerability in Docker-Compose by Apache

CVE-2026-74756

What is CVE-2026-74756?

The Docker-Compose tool by Apache exposes the Webadmin REST API by default without adequate authentication measures. This vulnerability allows unauthorized public access to sensitive functions. Starting from version 3.9.1, Apache has implemented a mechanism that assigns random default credentials to these endpoints to enhance security while maintaining user convenience. Users are still encouraged to configure authentication correctly to ensure comprehensive protection.

References