What is the CVSS score of CVE-2026-40089?

CVE-2026-40089 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L. EPSS exploitation probability: 0.0%.

Which versions of Docker are affected by CVE-2026-40089?

CVE-2026-40089 is a critical server-side request forgery (SSRF) vulnerability in Sonicverse Radio's dashboard API that allows authenticated operators to bypass network boundaries and access internal…

How to fix or mitigate CVE-2026-40089?

Within 24 hours: Identify all Sonicverse Radio deployments using Docker Compose with the standard install.sh script and restrict network access to the dashboard API to trusted operators only via firewall/WAF rules. Within 7 days: Implement compensating controls-isolate affected Docker containers from access to internal services, cloud metadata endpoints (169.254.169.254), and inter-service communication; audit logs for suspicious HTTP requests originating from dashboard API. Within 30 days: Monitor Sonicverse Radio vendor advisories for patch release; prepare upgrade plan to patched version immediately upon availability; consider alternative audio streaming solutions if patch timeline becomes unacceptable for your risk tolerance.

Docker CVE-2026-40089

EUVD-2026-21065 CRITICAL

Server-Side Request Forgery (SSRF) (CWE-918)

2026-04-09 GitHub_M

Docker SSRF

9.9

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

EUVD ID Assigned

Apr 09, 2026 - 20:15 euvd

EUVD-2026-21065

Analysis Generated

Apr 09, 2026 - 20:15 vuln.today

CVE Published

Apr 09, 2026 - 19:43 nvd

CRITICAL 9.9

DescriptionGitHub Advisory

Sonicverse is a Self-hosted Docker Compose stack for live radio streaming. The Sonicverse Radio Audio Streaming Stack dashboard contains a Server-Side Request Forgery (SSRF) vulnerability in its API client (apps/dashboard/lib/api.ts). Installations created using the provided install.sh script (including the one‑liner bash <(curl -fsSL https://sonicverse.short.gy/install-audiostack)) are affected. In these deployments, the dashboard accepts user-controlled URLs and passes them directly to a server-side HTTP client without sufficient validation. An authenticated operator can abuse this to make arbitrary HTTP requests from the dashboard backend to internal or external systems. This vulnerability is fixed with commit cb1ddbacafcb441549fe87d3eeabdb6a085325e4.

AnalysisAI

Server-Side Request Forgery in Sonicverse Radio Audio Streaming Stack dashboard API client allows authenticated operators to perform arbitrary HTTP requests from the backend server to internal or external targets. Affects Docker Compose deployments installed via the provided install.sh script, including one-liner installations. Attacker can exploit insufficient URL validation in apps/dashboard/lib/api.ts to access internal services, exfiltrate sensitive data from cloud metadata endpoints, or pivot to restricted network segments. CVSS 9.9 critical severity with changed scope indicates potential for significant cross-boundary impact. No public exploit identified at time of analysis.

Technical ContextAI

Root cause is absent input validation in the dashboard's TypeScript API client (apps/dashboard/lib/api.ts) where user-supplied URLs are passed directly to server-side HTTP client without sanitization, allowlist checks, or network segmentation controls. CWE-918 Server-Side Request Forgery manifests through the dashboard backend accepting attacker-controlled destination parameters, enabling requests to RFC 1918 private addresses, loopback interfaces, and cloud instance metadata services.

RemediationAI

Upstream fix available (commit cb1ddbacafcb441549fe87d3eeabdb6a085325e4); released patched version not independently confirmed. Immediate action: update to commit cb1ddbacafcb441549fe87d3eeabdb6a085325e4 or later by pulling latest repository changes and rebuilding Docker containers. For installations unable to update immediately, implement network-level egress filtering to block dashboard container outbound access to internal IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.0/8, 169.254.169.254/32) and restrict API access to essential operators only. Vendor advisory: https://github.com/sonicverse-eu/audiostreaming-stack/security/advisories/GHSA-8vvj-7f7r-7v48. Authentication requirement (CVSS PR:L) limits attack surface to users with operator credentials; review and audit operator account access as defense-in-depth measure.