Is there a patch available for EUVD-2026-43298?

Yes, a patch is available for EUVD-2026-43298. Update the affected software to the latest version immediately.

Isaiah EUVD-2026-43298

Q: What is the CVSS score of EUVD-2026-43298?

EUVD-2026-43298 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

| CVE-2026-15541 MEDIUM

Missing Authorization (CWE-862)

2026-07-13 VulDB

GHSA-ch9v-gm7f-9q33

Authentication Bypass Isaiah

6.9

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.3 HIGH

Network-reachable WebSocket handler with no privilege requirement; low uniform impact reflects limited per-request Docker agent access without full system compromise.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 08:23 vuln.today

DescriptionCVE.org

A flaw has been found in will-moss Isaiah up to 1.36.9. The impacted element is the function Server.Handle of the file app/server/server/server.go of the component Master Websocket Handler. Executing a manipulation of the argument Agent can lead to missing authorization. It is possible to launch the attack remotely. The pull request to fix this issue awaits acceptance.

AnalysisAI

Missing authorization in Isaiah's Master WebSocket Handler allows remote unauthenticated attackers to manipulate the Agent argument in the Server.Handle function, bypassing access controls over Docker management operations. All versions of the will-moss/isaiah project up to and including 1.36.9 are affected. No public exploit or active exploitation has been identified at time of analysis; a fix pull request (#35) exists upstream but awaits acceptance.

Technical ContextAI

Isaiah (cpe:2.3:a:will-moss:isaiah:*:*:*:*:*:*:*:*) is a self-hosted, web-based Docker management interface written in Go. The vulnerable code resides in app/server/server/server.go within the Server.Handle function, which acts as the Master WebSocket Handler for agent communication. CWE-862 (Missing Authorization) identifies the root cause: the handler processes inbound WebSocket messages referencing an Agent parameter without verifying that the sender holds the authority to address or direct that agent. Because the WebSocket protocol lacks built-in authorization enforcement, any caller who can reach the endpoint can craft a message that invokes agent-level Docker operations without legitimate credentials.

RemediationAI

No officially released patched version has been confirmed - the fix exists only as GitHub pull request #35 (https://github.com/will-moss/isaiah/pull/35), which awaits upstream acceptance. Organizations should monitor PR #35 for merge and release, then upgrade promptly once a patched version is tagged. As a compensating control, restrict network access to the Isaiah WebSocket endpoint by placing the service behind a VPN, reverse proxy with authentication, or firewall rules that limit inbound WebSocket connections to trusted IP ranges only - this directly removes the unauthenticated remote attack vector. Blocking external access has minimal operational trade-off for a self-hosted internal tool. Do not expose Isaiah on public-facing networks until a patched release is available.