EUVD-2026-43299
GHSA-9cxj-6mj4-pxvp
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable WebSocket auth bypass requires no privileges or interaction; limited C/I/A impact consistent with Docker UI access, scope unchanged per 4.0 SC:N.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
1DescriptionCVE.org
A vulnerability has been found in will-moss Isaiah up to 1.36.9. This affects an unknown function of the file app/main.go of the component Websocket Connection Authentication. The manipulation leads to improper authentication. The attack can be initiated remotely. The pull request to fix this issue awaits acceptance.
AnalysisAI
Improper WebSocket authentication in will-moss Isaiah up to version 1.36.9 permits unauthenticated remote attackers to establish authenticated WebSocket sessions against the Docker management interface. The flaw resides in app/main.go within the WebSocket Connection Authentication component, where authentication controls can be bypassed, granting access to Docker management functionality without valid credentials. No public exploit has been identified at time of analysis, and an upstream fix exists as a pending pull request (PR #36) that has not yet been merged into a released version.
Technical ContextAI
Isaiah is a self-hosted, web-based Docker management UI written in Go, exposing a WebSocket interface for real-time interaction with the Docker daemon on the host. The affected component is the WebSocket Connection Authentication handler in app/main.go. CWE-287 (Improper Authentication) indicates that the application fails to correctly verify the identity or authorization status of WebSocket clients before granting session access. In practice, this means the server-side WebSocket upgrade handler either skips, short-circuits, or fails to enforce credential validation, allowing a client to obtain a functional management session. The CPE is cpe:2.3:a:will-moss:isaiah:*:*:*:*:*:*:*:*, covering all versions through 1.36.9.
RemediationAI
No released patched version has been independently confirmed at time of analysis; the upstream fix exists as a pending pull request at https://github.com/will-moss/isaiah/pull/36 which has not yet been merged or tagged as a release. Users should monitor the repository for merge and release of PR #36 and upgrade immediately upon release. As compensating controls prior to patch availability, restrict network access to the Isaiah interface using firewall rules or reverse-proxy authentication (e.g., nginx with HTTP Basic Auth or mutual TLS) to require authentication before WebSocket connections can be initiated - this adds an authentication layer at the network edge and prevents unauthenticated clients from reaching the vulnerable endpoint. Additionally, avoid exposing Isaiah on public or untrusted network interfaces; bind the service to localhost or a private network segment only. Disabling Isaiah entirely in favor of authenticated Docker management alternatives (e.g., Portainer with proper auth configuration) is a viable alternative if the patch timeline is unacceptable.
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today