Tugtainer CVE-2025-69201

Exploitation requires network access to the tugtainer-agent's POST api/command/run endpoint on a Tugtainer instance running a version prior to 1.15.1, where the command schema performed no validation of arguments before dispatching them. The concrete prerequisite is reachability of that specific agent API endpoint; the injection point is the command argument list accepted by command_schemas.py. Limiting factors: the attack surface is confined to deployments that expose the agent endpoint to the attacker (homelab/self-hosted installs may keep agents on private/internal networks, sharply reducing real exposure), and while the supplied vector rates PR:N, the description does not confirm whether the endpoint enforces authentication/tokens - if it does, an attacker would also need valid credentials. No user interaction is required and no special non-default feature toggle is implicated.

This is a genuine high-impact vulnerability in principle - CWE-77 command argument injection in Tugtainer's agent endpoint (POST api/command/run) that, per the vendor-supplied CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N), is remotely reachable, low-complexity, and requires no privileges or user interaction, yielding high confidentiality, integrity, and availability impact (VC:H/VI:H/VA:H). The source-code evidence confirms the root cause: before 1.15.1 the command schema accepted arbitrary list arguments with no validator, and the fix introduces an allowlist-based command_validator restricting commands, flags, and positional args. However, real-world urgency is tempered by several signals: the CVSS 4.0 exploit-maturity metric is E:U (Unproven), there is no CISA KEV listing and no public POC, and the affected product is a niche self-hosted container-automation tool with a small deployment footprint. So this is a 'high CVSS, low aggregate real-world risk' case driven by low prevalence and no evidence of exploitation - real priority for the few operators running exposed Tugtainer agents, low priority at fleet scale. One caveat to verify: the vector asserts PR:N (unauthenticated), but the description does not state whether the tugtainer-agent command endpoint enforces authentication; if the agent is normally protected by a token or private network, effective exploitability is narrower than the vector implies - verify endpoint auth with the vendor/advisory.

An attacker with network reach to a Tugtainer agent (version <1.15.1) sends a crafted POST to api/command/run containing extra/arbitrary arguments that the unvalidated command schema passes through to the underlying docker invocation, altering command behavior to run attacker-chosen operations on the container host. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no authentication or user interaction is modeled as required, though exploitation depends on the agent endpoint being network-reachable. No public exploit code is identified (exploit maturity E:U), so an attacker would need to develop the request against the known injection point.