by Kastro
Paper/Archive/CVE-2026-23846

CVE-2026-23846

Quenary tugtainer — Tugtainer vulnerable to Password Exposure via URL Query Parameter

EPSS 0.5%public exploitCVSS 9.1
critical.is priorityof 100
45
CVSS 9.1 (NVD)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 40.2.402 × 208.0Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

Tugtainer is a self-hosted app for automating updates of Docker containers. In versions prior to 1.16.1, the password authentication mechanism transmits passwords via URL query parameters instead of the HTTP request body. This causes passwords to be logged in server access logs and potentially exposed through browser history, Referer headers, and proxy logs. Version 1.16.1 patches the issue.

Affected

ProductAffectedFixed inSource
tugtainer< 1.16.1–CNA

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
GitHub_M (CNA)8.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: partial

References

refgithub.com/Quenary/tugtainer/security/advisories/GHSA-f2qf-f544-xm4prefgithub.com/Quenary/tugtainer/commit/9d23bf40ac1d39005582abfcf0a84753a4e29d52