CVE-2026-15542: Isaiah Websocket Authentication Bypass

CVE-2026-15542 Overview

CVE-2026-15542 is an improper authentication vulnerability [CWE-287] affecting the will-moss Isaiah project up to version 1.36.9. Isaiah is an open-source Docker management interface written in Go. The flaw resides in the WebSocket Connection Authentication component implemented in app/main.go. An unknown function fails to properly validate authentication data, allowing remote attackers to bypass authentication controls over the network. No user interaction or prior privileges are required to exploit the weakness. The patch is tracked in an upstream pull request that, according to public reporting, awaits acceptance at the time of disclosure.

Critical Impact
Remote attackers can bypass WebSocket authentication in Isaiah to gain unauthorized access to the Docker management interface exposed by the application.

Affected Products

will-moss Isaiah versions up to and including 1.36.9
Deployments exposing the Isaiah WebSocket endpoint over the network
Docker environments managed through vulnerable Isaiah instances

Discovery Timeline

2026-07-13 - CVE-2026-15542 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-15542

Vulnerability Analysis

The vulnerability is classified as improper authentication under [CWE-287]. It affects the WebSocket handshake and authentication logic in app/main.go. Isaiah exposes an interactive interface that communicates with the backend over a WebSocket channel. When authentication for the WebSocket connection is not enforced correctly, a remote unauthenticated client can establish a session and interact with the application as if it were an authorized user. Because Isaiah is used to manage Docker resources, bypassing authentication can translate into unauthorized visibility and control of the underlying container environment.

Root Cause

The root cause is inadequate verification of client identity during the WebSocket connection lifecycle. Public references indicate the fix is proposed in GitHub Pull Request #36, which addresses the authentication logic flagged in GitHub Issue #33. Until that pull request is merged and released, deployments running versions up to 1.36.9 remain exposed.

Attack Vector

Exploitation is performed remotely over the network. An attacker who can reach the Isaiah WebSocket endpoint sends a crafted connection request that bypasses the authentication check. No credentials, tokens, or user interaction are required. Once connected, the attacker can issue WebSocket messages that Isaiah processes as if they originated from an authorized session. The vulnerability leads to limited losses across confidentiality, integrity, and availability of the managed Docker environment.

No verified public proof-of-concept code is available. See the VulDB entry for CVE-2026-15542 and the Isaiah project repository for further technical context.

Detection Methods for CVE-2026-15542

Indicators of Compromise

Unexpected WebSocket upgrade requests to the Isaiah endpoint originating from unknown IP addresses or user agents.
WebSocket sessions established without a preceding successful HTTP authentication exchange.
Docker API activity initiated through Isaiah that does not correlate with legitimate administrator sessions.

Detection Strategies

Inspect reverse proxy and application logs for Upgrade: websocket requests to Isaiah paths without valid session cookies or authentication headers.
Correlate WebSocket connection events in app/main.go handlers with authenticated login events; flag connections that lack a matching authentication record.
Monitor container lifecycle events (create, start, stop, exec) triggered via Isaiah for actions outside change-management windows.

Monitoring Recommendations

Enable verbose access logging on the Isaiah service and any fronting reverse proxy such as Nginx, Traefik, or Caddy.
Forward Isaiah and Docker daemon logs to a centralized log platform and alert on anomalous WebSocket source IPs or geolocations.
Baseline normal administrator activity, then alert on deviations in WebSocket connection volume, session duration, and issued commands.

How to Mitigate CVE-2026-15542

Immediate Actions Required

Restrict network exposure of Isaiah by binding it to 127.0.0.1 or an internal management network and placing it behind an authenticating reverse proxy.
Enforce network-layer access controls such as firewall rules, VPN, or Zero Trust access to the Isaiah WebSocket endpoint.
Rotate any credentials or tokens managed through Isaiah if unauthorized access is suspected, and audit Docker resources for unexpected changes.

Patch Information

A fix has been proposed upstream in GitHub Pull Request #36, which addresses Issue #33. At the time of publication the pull request awaits acceptance, so no fixed release version is available. Operators should track the Isaiah repository for a release that incorporates the WebSocket authentication fix and upgrade as soon as it is published.

Workarounds

Place Isaiah behind an authenticating reverse proxy that enforces HTTP Basic Auth, mTLS, or single sign-on before allowing WebSocket upgrades.
Limit inbound access to the Isaiah port using host firewall rules (iptables, nftables, or cloud security groups) so only trusted administrator IPs can connect.
Disable or take Isaiah offline in production until an official patched release is available if compensating controls cannot be applied.

bash

# Example: restrict Isaiah to localhost and require reverse proxy authentication
# 1. Bind the service to loopback in your compose or systemd unit
#    ports:
#      - "127.0.0.1:5000:5000"

# 2. Front it with an authenticating reverse proxy (Nginx example)
location /isaiah/ {
    auth_basic           "Isaiah Admin";
    auth_basic_user_file /etc/nginx/.htpasswd;

    proxy_pass           http://127.0.0.1:5000/;
    proxy_http_version   1.1;
    proxy_set_header     Upgrade $http_upgrade;
    proxy_set_header     Connection "upgrade";
    proxy_set_header     Host $host;
}

# 3. Restrict inbound access at the host firewall
sudo iptables -A INPUT -p tcp --dport 5000 ! -s 10.0.0.0/24 -j DROP