What is the CVSS score of CVE-2026-39848?

CVE-2026-39848 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-39848?

Yes, a patch is available for CVE-2026-39848. Update the affected software to the latest version immediately.

Docker CVE-2026-39848

EUVD-2026-21210 MEDIUM

Missing Authentication for Critical Function (CWE-306)

2026-04-09 security-advisories@github.com

Docker CSRF Authentication Bypass PHP Dockyard

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

CVSS changed

Jul 08, 2026 - 14:52 NVD

6.5 (MEDIUM) 5.4 (MEDIUM)

Patch available

Apr 16, 2026 - 05:29 EUVD

1.1.0

EUVD ID Assigned

Apr 09, 2026 - 22:22 euvd

EUVD-2026-21210

Analysis Generated

Apr 09, 2026 - 22:22 vuln.today

CVE Published

Apr 09, 2026 - 22:16 nvd

MEDIUM 6.5

DescriptionNVD

Dockyard is a Docker container management app. Prior to 1.1.0, Docker container start and stop operations are performed through GET requests without CSRF protection. A remote attacker can cause a logged-in administrator's browser to request /apps/action.php?action=stop&name=<container> or /apps/action.php?action=start&name=<container>, which starts or stops the target container. This vulnerability is fixed in 1.1.0.

AnalysisAI

CSRF vulnerability in Dockyard prior to 1.1.0 allows unauthenticated remote attackers to start or stop Docker containers by tricking a logged-in administrator into clicking a malicious link, since container control endpoints accept GET requests without CSRF token validation. An attacker can disrupt service availability or trigger unintended container state changes without authentication credentials. No active exploitation or public exploit code has been confirmed.

Technical ContextAI

Dockyard is a Docker container management application built in PHP. The vulnerability stems from a missing CSRF protection mechanism (CWE-306: Missing Cryptographic Step) on state-changing operations exposed via GET requests. The affected endpoints (/apps/action.php?action=stop&name=<container> and /apps/action.php?action=start&name=<container>) perform sensitive container operations without requiring synchronizer tokens or same-site cookie attributes. This is a fundamental PHP web application design flaw-GET requests should never perform state changes, and all state-modifying operations should be protected with CSRF tokens. The lack of CSRF protection combined with GET-based actions means any external website, email, or malicious content can trigger these operations if visited by an authenticated administrator.

RemediationAI

Upgrade Dockyard to version 1.1.0 or later immediately, which includes CSRF protection on container control endpoints. For organizations unable to upgrade immediately, implement a Web Application Firewall rule to block GET requests to /apps/action.php with action parameters, force POST-only access, and add browser security headers (SameSite=Strict on session cookies, Content-Security-Policy). Additionally, restrict administrative access to Dockyard to internal networks only and educate administrators to avoid clicking untrusted links while authenticated. The official fix is available via the GitHub Security Advisory at https://github.com/10ij/dockyard/security/advisories/GHSA-jrf6-3j4j-q36g.