Tugtainer EUVD-2026-90194

Requires an authenticated Tugtainer session (PR:L) with access to the notification settings; the vulnerable path is the /settings/test_notification endpoint's urls field, which pre-1.30.6 is passed straight to Apprise with NO scheme/host/IP filtering in the default configuration (the new NOTIFICATION_ALLOW_* env vars and RESTRICTED_NETWORKS deny-list did not exist before the patch). Exploitation is LIMITED by: (1) mandatory authentication - this is not exposed to anonymous internet users; (2) the blind nature - no response data is returned, so pure data exfiltration from metadata endpoints is constrained to what can be inferred indirectly; (3) the attacker needs network reachability from the Tugtainer backend to the intended internal/metadata target. Any deployment on version <1.30.6 with default settings is affected regardless of platform.

Signals conflict on severity. The vendor CVSS of 9.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L) is inflated for what the description explicitly calls a *blind* SSRF: if the response body is never returned to the attacker, C:H is not justified - realistic confidentiality impact is C:L at most, so the practical severity is closer to high-7 than critical-9. The vector's PR:L is consistent with the description's 'authenticated user' requirement, meaning this is not an unauthenticated internet-facing flaw. There is no EPSS score, no CISA KEV listing, and no public exploit identified at time of analysis, so this is not a validated widespread-exploitation priority. SSVC-wise: exploitation is not observed, the technique is automatable in principle (simple POST to a known endpoint), but technical impact is partial given the blind constraint and single-privilege gate. Net: a legitimate bug worth patching, but the raw 9.1 overstates real-world urgency for a niche self-hosted homelab tool that requires an authenticated session.

An attacker who already holds a valid Tugtainer login (or a low-privileged operator account) sends a POST to /settings/test_notification with a urls value pointing at an internal address such as http://169.254.169.254/latest/meta-data/ or a private-range service. The backend forwards the request via Apprise, letting the attacker probe internal hosts, cloud metadata endpoints, and private services from the server's network position. Because the SSRF is blind, the attacker infers reachability from timing/error behavior rather than reading responses; no public exploit code is identified at time of analysis.