What is the CVSS score of CVE-2026-47752?

CVE-2026-47752 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Tugtainer are affected by CVE-2026-47752?

Tugtainer, a self-hosted Docker container auto-update tool, contains a critical template injection vulnerability (CVE-2026-47752, CVSS 9.9) affecting versions before 1.30.2 that allows authenticated…. A patch is available.

How to fix or mitigate CVE-2026-47752?

Within 24 hours: Inventory all Tugtainer deployments and identify instances running versions prior to 1.30.2, then immediately revoke or restrict admin-level authenticated access to affected systems. Within 7 days: Implement network segmentation to isolate Tugtainer management interfaces from untrusted networks, disable or replace custom notification templates pending a vendor patch, and audit all recent template configuration changes for signs of exploitation. Within 30 days: Monitor the Tugtainer project for patch release (targeting version 1.30.2 or later), establish a change management process for template updates, and evaluate alternative container orchestration solutions if no stable patch is released within 60 days.

Tugtainer CVE-2026-47752

EUVD-2026-48329 CRITICAL

Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)

2026-07-23 GitHub_M

Docker Code Injection Ssti Tugtainer

9.9

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Authenticated user (PR:L) sends a network request (AV:N) with no interaction; unsandboxed Jinja2 escapes to root OS execution, a scope change (S:C) yielding full C/I/A impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jul 23, 2026 - 19:03 EUVD

Analysis Generated

Jul 23, 2026 - 17:45 vuln.today

CVE Published

Jul 23, 2026 - 16:57 cve.org

CRITICAL 9.9

DescriptionCVE.org

Tugtainer is a self-hosted app for automating updates of Docker containers. Versions prior to 1.30.2 are vulnerable to Server-Side Template Injection (SSTI) in the notification template feature. The title_template and body_template fields are rendered using an unsandboxed jinja2.Environment, allowing any authenticated user to execute arbitrary OS commands as root inside the container. Version 1.30.2 fixes the issue.

Articles & Coverage 2

News 3 New Docker Vulnerabilities - 1 Critical, 2 With POC Jul 24, 2026 News Critical SSTI RCE in Tugtainer Docker Tool - CVE-2026-47752 Jul 23, 2026

AnalysisAI

Server-side template injection in Tugtainer (self-hosted Docker container auto-update tool) versions before 1.30.2 lets any authenticated user achieve root-level OS command execution by injecting Jinja2 expressions into notification templates. The title_template and body_template fields are rendered by an unsandboxed jinja2.Environment, so template payloads escape into arbitrary code running as root inside the container. Rated CVSS 9.9 with a scope change; no public exploit identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

The flaw is CWE-1336 (Improper Neutralization of Special Elements Used in a Template Engine), the SSTI-specific weakness class. Tugtainer's notification feature accepts user-controlled title_template and body_template strings and passes them to a raw jinja2.Environment rather than jinja2.sandbox.SandboxedEnvironment. Jinja2's object model exposes Python internals through attributes such as __class__, __mro__, __subclasses__, and __globals__, which an attacker chains to reach os.system or subprocess and run shell commands. Because Tugtainer runs with the Docker socket and root privileges typical of container-management tooling, that code executes as root inside the container. The affected package is identified by CPE cpe:2.3:a:quenary:tugtainer:*:*:*:*:*:*:*:*.

RemediationAI

Vendor-released patch: 1.30.2 - upgrade Tugtainer to 1.30.2 or later, which remediates the SSTI, and pull the corresponding container image and redeploy. If an immediate upgrade is not possible, restrict who can reach and authenticate to the Tugtainer instance (place it behind a VPN or trusted network segment and remove any public exposure), and limit accounts to trusted administrators only since any authenticated user can trigger the flaw; avoid granting notification-template editing to untrusted users. As defense in depth, run the container as a non-root user and drop unnecessary capabilities where the deployment allows, accepting that this may break Tugtainer's ability to manage other containers via the Docker socket. Consult the vendor advisory at https://github.com/Quenary/tugtainer/security/advisories/GHSA-g2cj-2x47-78vq for authoritative guidance.