Tugtainer
Monthly
In Tugtainer versions before 1.31.3, the OIDC login flow accepts unverified JWT claims from the identity provider's id_token, allowing an unauthenticated remote attacker who can influence the token exchange to impersonate any identity and gain full control of the Tugtainer session. The flaw is a pre-authentication authentication bypass (CWE-347) with high confidentiality, integrity, and availability impact once triggered; exploitation requires OIDC to be configured and enabled. No public exploit has been identified at the time of analysis, and the issue is not listed in CISA KEV. A vendor patch is available in version 1.31.3.
Authenticated server-side request forgery in Tugtainer before version 1.30.6 allows any logged-in user with access to notification settings to make the backend send outbound HTTP requests to attacker-chosen URLs through the /settings/test_notification endpoint, reaching localhost, RFC1918 ranges, and cloud metadata addresses such as 169.254.169.254. The urls field is passed directly to the Apprise notification library with no scheme, hostname, private-IP, or metadata filtering in the default configuration, and because responses are not returned to the caller the attack is blind, which limits it to internal port scanning, service probing, and indirect information inference rather than straightforward data exfiltration. Our independent assessment agrees with the SSRF class and the authentication prerequisite (PR:L) but rates the CIA impact lower (C:L/I:L/A:L) than the vendor's 9.1 scoring, so the practical severity sits below the headline score; vendor-released patch: 1.30.6, and no public exploit identified at time of analysis, with no CISA KEV listing.
Unauthenticated attackers can reach the Tugtainer Agent's Docker management API and gain effectively full control over containers and the underlying Docker host, because the agent's request-signature check in agent/auth.py returns success whenever Config.AGENT_SECRET is left empty - which is the shipped default. All Tugtainer versions prior to 1.30.4 are affected (CPE cpe:2.3:a:quenary:tugtainer with a wildcard version), though exploitation requires the agent's port (default 127.0.0.1:8001) to be network-reachable, meaning deployments that place the agent on a separate host or otherwise expose it without setting a secret are the realistic victims; deployments that keep the agent internal or set AGENT_SECRET are not reachable. The CVSS 3.1 score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), no public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis, and the issue is fixed in vendor release 1.30.4, which rejects such requests with HTTP 401.
Improper access control in Tugtainer before version 1.30.3 causes the OIDC login flow to start even when OIDC_ENABLED=false, so a direct request to /auth/oidc/login still returns HTTP 302, sets an oidc_state cookie, and redirects the browser to the configured OIDC authorization endpoint despite the disable switch. The vendor scores this 9.4 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L), but real-world impact is narrower than that score implies: exploitation requires a deployment where OIDC was fully configured (well_known_url, client ID/secret, authorization endpoint) and then toggled off, and the attacker must still complete authentication against that external identity provider to turn the initiated flow into a session. No public exploit code and no confirmed active exploitation were identified at time of analysis; the issue is fixed in Tugtainer 1.30.3.
Server-side template injection in Tugtainer (self-hosted Docker container auto-update tool) versions before 1.30.2 lets any authenticated user achieve root-level OS command execution by injecting Jinja2 expressions into notification templates. The title_template and body_template fields are rendered by an unsandboxed jinja2.Environment, so template payloads escape into arbitrary code running as root inside the container. Rated CVSS 9.9 with a scope change; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Tugtainer versions before 1.16.1 transmit authentication credentials through URL query parameters rather than request bodies, causing passwords to be exposed in server logs, browser history, and proxy logs. This exposure allows attackers with access to these logs or cached data to obtain valid credentials for the Docker container management system. Public exploit code exists for this vulnerability, and a patch is available in version 1.16.1.
Command argument injection in the Tugtainer agent API (POST api/command/run) lets remote attackers append or substitute arbitrary arguments to commands the agent dispatches, potentially achieving command execution or otherwise manipulating Docker on the host. All Tugtainer deployments running versions prior to 1.15.1 are affected, including the Docker-packaged builds identified by the affected CPE; the vendor's CVSS 4.0 vector (8.1, AV:N/AC:L/AT:N/PR:N/UI:N, VC:H/VI:H/VA:H) rates it as remotely reachable, low-complexity, and unauthenticated, though the advisory does not confirm whether the agent endpoint enforces a token, so an additional credential requirement cannot be ruled out in hardened setups. No public exploit code and no confirmed active exploitation were identified at time of analysis.
In Tugtainer versions before 1.31.3, the OIDC login flow accepts unverified JWT claims from the identity provider's id_token, allowing an unauthenticated remote attacker who can influence the token exchange to impersonate any identity and gain full control of the Tugtainer session. The flaw is a pre-authentication authentication bypass (CWE-347) with high confidentiality, integrity, and availability impact once triggered; exploitation requires OIDC to be configured and enabled. No public exploit has been identified at the time of analysis, and the issue is not listed in CISA KEV. A vendor patch is available in version 1.31.3.
Authenticated server-side request forgery in Tugtainer before version 1.30.6 allows any logged-in user with access to notification settings to make the backend send outbound HTTP requests to attacker-chosen URLs through the /settings/test_notification endpoint, reaching localhost, RFC1918 ranges, and cloud metadata addresses such as 169.254.169.254. The urls field is passed directly to the Apprise notification library with no scheme, hostname, private-IP, or metadata filtering in the default configuration, and because responses are not returned to the caller the attack is blind, which limits it to internal port scanning, service probing, and indirect information inference rather than straightforward data exfiltration. Our independent assessment agrees with the SSRF class and the authentication prerequisite (PR:L) but rates the CIA impact lower (C:L/I:L/A:L) than the vendor's 9.1 scoring, so the practical severity sits below the headline score; vendor-released patch: 1.30.6, and no public exploit identified at time of analysis, with no CISA KEV listing.
Unauthenticated attackers can reach the Tugtainer Agent's Docker management API and gain effectively full control over containers and the underlying Docker host, because the agent's request-signature check in agent/auth.py returns success whenever Config.AGENT_SECRET is left empty - which is the shipped default. All Tugtainer versions prior to 1.30.4 are affected (CPE cpe:2.3:a:quenary:tugtainer with a wildcard version), though exploitation requires the agent's port (default 127.0.0.1:8001) to be network-reachable, meaning deployments that place the agent on a separate host or otherwise expose it without setting a secret are the realistic victims; deployments that keep the agent internal or set AGENT_SECRET are not reachable. The CVSS 3.1 score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), no public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis, and the issue is fixed in vendor release 1.30.4, which rejects such requests with HTTP 401.
Improper access control in Tugtainer before version 1.30.3 causes the OIDC login flow to start even when OIDC_ENABLED=false, so a direct request to /auth/oidc/login still returns HTTP 302, sets an oidc_state cookie, and redirects the browser to the configured OIDC authorization endpoint despite the disable switch. The vendor scores this 9.4 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L), but real-world impact is narrower than that score implies: exploitation requires a deployment where OIDC was fully configured (well_known_url, client ID/secret, authorization endpoint) and then toggled off, and the attacker must still complete authentication against that external identity provider to turn the initiated flow into a session. No public exploit code and no confirmed active exploitation were identified at time of analysis; the issue is fixed in Tugtainer 1.30.3.
Server-side template injection in Tugtainer (self-hosted Docker container auto-update tool) versions before 1.30.2 lets any authenticated user achieve root-level OS command execution by injecting Jinja2 expressions into notification templates. The title_template and body_template fields are rendered by an unsandboxed jinja2.Environment, so template payloads escape into arbitrary code running as root inside the container. Rated CVSS 9.9 with a scope change; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Tugtainer versions before 1.16.1 transmit authentication credentials through URL query parameters rather than request bodies, causing passwords to be exposed in server logs, browser history, and proxy logs. This exposure allows attackers with access to these logs or cached data to obtain valid credentials for the Docker container management system. Public exploit code exists for this vulnerability, and a patch is available in version 1.16.1.
Command argument injection in the Tugtainer agent API (POST api/command/run) lets remote attackers append or substitute arbitrary arguments to commands the agent dispatches, potentially achieving command execution or otherwise manipulating Docker on the host. All Tugtainer deployments running versions prior to 1.15.1 are affected, including the Docker-packaged builds identified by the affected CPE; the vendor's CVSS 4.0 vector (8.1, AV:N/AC:L/AT:N/PR:N/UI:N, VC:H/VI:H/VA:H) rates it as remotely reachable, low-complexity, and unauthenticated, though the advisory does not confirm whether the agent endpoint enforces a token, so an additional credential requirement cannot be ruled out in hardened setups. No public exploit code and no confirmed active exploitation were identified at time of analysis.