Tugtainer Agent EUVD-2026-90193

Requires two conditions to align: (1) AGENT_SECRET is unset/empty - this is the default, causing verify_signature_headers in agent/auth.py to return success for any request; and (2) the Tugtainer Agent port (default 127.0.0.1:8001) is network-reachable to the attacker. By default the Agent is bound internally within the main image and its port is not exposed, so remote unauthenticated exploitation specifically requires a deployment that exposes the Agent (e.g., agent on a separate host/network) while leaving AGENT_SECRET blank. Limiting factors: the non-default port exposure requirement significantly narrows real-world reachability; deployments that set AGENT_SECRET or upgrade to v1.30.4 (which rejects requests with HTTP 401 when the secret is unset) are not affected.

The CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects worst-case impact: unauthenticated network access to Docker management APIs yields effectively full control of containers and, by extension, the Docker host. The root cause is confirmed by the fix commit (0052a5544e) - in agent/auth.py the signature check short-circuits to success when Config.AGENT_SECRET is empty, and empty is the documented default. However, the raw 9.8 overstates real-world exposure: the vendor's own .env.example notes the agent 'is used internally in the main image and does not expose its port,' binding to 127.0.0.1:8001 by default. So the network-reachable, unauthenticated condition only materializes when an operator exposes the agent port (common in multi-host setups) while leaving AGENT_SECRET unset. No EPSS score, KEV listing, or public PoC was provided, so there is no evidence of active exploitation - this is a high-impact, easy-to-trigger flaw but not a confirmed widespread-exploitation priority. SSVC-style read: technical impact is total, exploitation is trivial once reachable and likely automatable, but the affected product footprint is small. Missing data: EPSS/KEV/POC status not supplied - treat exploitation likelihood as inferred, not confirmed.

An operator deploys Tugtainer in a multi-host configuration and exposes the Agent port on the network without setting AGENT_SECRET. An unauthenticated remote attacker who can reach that port sends requests to the protected Agent API without any valid signature - the verification passes because the secret is empty - and issues Docker management commands to pull, start, or reconfigure containers, pivoting to full host compromise. No public PoC was identified, but the fix commit publicly documents the exact flawed check, making a working exploit trivial to reconstruct.