CVE-2026-15541: will-moss Isaiah Auth Bypass Vulnerability

CVE-2026-15541 Overview

CVE-2026-15541 is a missing authorization vulnerability [CWE-862] in will-moss Isaiah versions up to 1.36.9. The flaw resides in the Server.Handle function within app/server/server/server.go, part of the Master Websocket Handler component. Manipulation of the Agent argument bypasses authorization checks, allowing remote attackers to interact with the websocket endpoint without proper credentials. The vulnerability is exploitable over the network with low attack complexity and no privileges or user interaction required. A pull request addressing the issue is pending acceptance in the upstream project.

Critical Impact
Remote attackers can bypass authorization on the Isaiah Master Websocket Handler by manipulating the Agent argument, gaining unauthorized interaction with the websocket interface.

Affected Products

will-moss Isaiah versions up to and including 1.36.9
Master Websocket Handler component (app/server/server/server.go)
Deployments exposing the Isaiah websocket endpoint over the network

Discovery Timeline

2026-07-13 - CVE-2026-15541 published to the National Vulnerability Database (NVD)
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-15541

Vulnerability Analysis

Isaiah is a lightweight web-based Docker management tool written in Go. The vulnerability is located in the Server.Handle function of app/server/server/server.go, which serves as the entry point for websocket connections routed through the Master Websocket Handler.

When a client connects and supplies the Agent argument, the handler fails to enforce an authorization check on the requesting principal. As a result, a remote unauthenticated actor can submit a crafted websocket request that is processed as if it originated from a trusted agent. Because Isaiah is designed to orchestrate Docker resources, unauthorized interaction with this endpoint exposes management operations that should require authenticated sessions.

The weakness is categorized under CWE-862: Missing Authorization. No public exploit is currently listed in Exploit-DB, and the flaw is not present on the CISA Known Exploited Vulnerabilities catalog.

Root Cause

The root cause is the absence of an authorization check on the Agent parameter path within the websocket handler. The code trusts the client-supplied value without validating whether the requesting entity is permitted to act as, or communicate with, the specified agent. This is a design-level omission rather than a memory safety issue.

Attack Vector

Exploitation requires network reachability to the Isaiah websocket endpoint. An attacker crafts a websocket connection request that manipulates the Agent argument to reach code paths intended for authorized agents. No credentials or user interaction are required, and complexity is low. The attack does not require access to the underlying host or Docker socket directly, only to the exposed Isaiah service.

No verified proof-of-concept code is provided. Technical details are tracked in the upstream GitHub Issue Tracker and the pending GitHub Pull Request.

Detection Methods for CVE-2026-15541

Indicators of Compromise

Unexpected inbound websocket upgrade requests to the Isaiah service from unfamiliar source addresses
Websocket messages carrying an Agent argument that does not correspond to a provisioned agent identifier
Docker container lifecycle events (start, stop, remove) originating from Isaiah without a preceding authenticated user session

Detection Strategies

Enable verbose logging on the Isaiah server and correlate websocket connection events with authenticated session identifiers to surface unauthenticated Agent interactions
Monitor the reverse proxy or load balancer fronting Isaiah for anomalous Upgrade: websocket requests lacking valid session cookies or bearer tokens
Baseline expected agent identifiers and alert when the Agent argument in websocket traffic deviates from the known set

Monitoring Recommendations

Forward Isaiah application logs and reverse proxy access logs to a centralized log platform for retention and correlation
Track Docker daemon audit events for orchestration actions that cannot be attributed to an authenticated Isaiah user
Alert on new outbound network connections initiated by containers immediately following anomalous websocket activity

How to Mitigate CVE-2026-15541

Immediate Actions Required

Restrict network exposure of the Isaiah service to trusted management networks or via VPN, removing any direct internet exposure
Place Isaiah behind a reverse proxy that enforces authentication on the websocket upgrade path until an upstream fix is merged
Audit Docker resources managed by Isaiah for unauthorized containers, images, or volumes created during the exposure window

Patch Information

At the time of publication, the fix is proposed in a pending GitHub Pull Request that has not yet been accepted. Administrators should monitor the Isaiah GitHub repository for a tagged release above 1.36.9 that incorporates the authorization check. See also the VulDB Vulnerability Report for tracking updates.

Workarounds

Terminate the Isaiah service on internet-facing hosts until an official patch is released
Enforce IP allow-listing at the network edge so only administrator workstations can reach the websocket port
Require mutual TLS or an authenticating proxy in front of Isaiah to reject unauthenticated websocket upgrade requests

bash

# Example: restrict Isaiah websocket port to a management subnet using iptables
iptables -A INPUT -p tcp --dport 5000 -s 10.0.10.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 5000 -j DROP