Yacht management pages inherit the Docker socket's authority

Yacht is a web interface for managing Docker containers and templates. A reachable Yacht page can therefore represent far more than a container-management dashboard. If the service mounts the Docker socket, its application authority can create containers, mount host paths and change the network position of workloads.

Comparing application and title evidence

On 2026-11-07 UTC, page-one count-only ZoomEye probes with sub_type=all returned 2,637 matches for app="Yacht" and 16,797 for title="Yacht". The title is generic and the larger result likely includes unrelated uses of the word. The application count is the stronger candidate set, but it still needs ownership and version validation.

The scanner does not show which hosts mount the Docker socket, whether authentication is enabled or whether the default password was changed. Those facts have to come from the deployment.

Remove defaults before exposure

Yacht's installation documentation lists [email protected] and pass as the default login and tells operators to change the password immediately. A default credential on a management surface is a direct access path. The README also documents DISABLE_AUTH, which disables authentication on the backend. A deliberate use of that setting belongs behind a trusted network boundary and an independent access control.

Review the Docker socket mount. If the UI runs inside a container and mounts the host socket, compromise of the UI is close to compromise of the Docker host. Restrict external access to the management network, use a unique administrative password, enable a supported SSO or forward-auth layer where available and back the deployment with host-level logging.

Treat container templates as code from a remote source. A template can request host mounts, privileged mode or unexpected images. Pin sources, review template changes and restrict who can deploy them.

Build a response sequence

For an owned candidate, verify the host identity, administration path, authentication state and Docker socket mount. Check for unexpected containers, volumes, host mounts and published ports. Rotate any shared administrative secret and revoke sessions after a change.

Use the app count as a lead and the title count as a broad reminder that product names can collide with ordinary language. Neither count is a vulnerability finding.

References

• Yacht Documentation: Install
• Yacht README