Tugtainer
CVE-2026-23846
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessUser visits malicious link with Tugtainer password in URL
-
ExploitBrowser sends request with password in query parameter
-
ExecutionPassword logged in server access logs
-
ImpactAttacker retrieves password from logs or browser history
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V4 - API and Web Service Sensitive data in POST not GET
|
| Exploitation Conditions | Tugtainer versions prior to 1.16.1 with password authentication enabled using URL query parameters instead of HTTP request body. User must click a crafted link containing password in URL (UI:R requirement). |
| Impact | CVSS 8.1 (HIGH). Attack vector: Network. Complexity: Low. Privileges required: None. User interaction: Required. Exploitation requires authentication. Public exploit/POC available. |
| Exploit ScenarioDerived | An attacker (requires authentication) could exploit this vulnerability to compromise the affected system. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
Tugtainer versions before 1.16.1 transmit authentication credentials through URL query parameters rather than request bodies, causing passwords to be exposed in server logs, browser history, and proxy logs. This exposure allows attackers with access to these logs or cached data to obtain valid credentials for the Docker container management system. Public exploit code exists for this vulnerability, and a patch is available in version 1.16.1.
Earlier versions of this analysis (1)
Tugtainer is a self-hosted app for automating updates of Docker containers. In versions prior to 1.16.1, the password authentication mechanism transmits passwords via URL query parameters instead of the HTTP request body. [CVSS 8.1 HIGH]
RemediationAI
A vendor patch is available — apply it immediately. Restrict network access to the affected service where possible.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Affects the URL query component of Tugtainer. Tugtainer is a self-hosted app for automating updates of Docker containers. In versions prior to 1.16.1, the password authentication mechanism transmits passwords via URL query parameters instead of the HTTP request body. This causes passwords to be logged in server access logs and potentially exposed through browser history, Referer headers, and proxy logs. Version 1.16.1 patches the issue.
Know when Tugtainer gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
3DescriptionGitHub Advisory
Tugtainer is a self-hosted app for automating updates of Docker containers. In versions prior to 1.16.1, the password authentication mechanism transmits passwords via URL query parameters instead of the HTTP request body. This causes passwords to be logged in server access logs and potentially exposed through browser history, Referer headers, and proxy logs. Version 1.16.1 patches the issue.
Executive ViewAI
Organizations using versions face notable risk from CVE-2026-23846 rated CVSS 8.1. Successful exploitation could significantly impact the confidentiality, integrity, or availability of affected systems. Proof-of-concept code is publicly available, increasing the risk of exploitation. A patch is available and should be applied as part of regular vulnerability management.
Apply vendor patch. If immediate patching is not feasible: (1) Implement network-level access controls to limit exposure; (2) Enable enhanced monitoring and alerting; (3) Apply principle of least privilege.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Affected Products (CPE)GitHub Advisory
Server-side template injection in Tugtainer (self-hosted Docker container auto-update tool) versions before 1.30.2 lets
Unauthenticated attackers can reach the Tugtainer Agent's Docker management API and gain effectively full control over c
Improper access control in Tugtainer before version 1.30.3 causes the OIDC login flow to start even when OIDC_ENABLED=fa
Authenticated server-side request forgery in Tugtainer before version 1.30.6 allows any logged-in user with access to no
Command argument injection in the Tugtainer agent API (POST api/command/run) lets remote attackers append or substitute
In Tugtainer versions before 1.31.3, the OIDC login flow accepts unverified JWT claims from the identity provider's id_t
Exploit-DB