CVE-2026-23846: falha de alta gravidade em Quenary tugtainer
Tugtainer vulnerable to Password Exposure via URL Query Parameter
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.1epss 0.5%
Tugtainer is a self-hosted app for automating updates of Docker containers. In versions prior to 1.16.1, the password authentication mechanism transmits passwords via URL query parameters instead of the HTTP request body. This causes passwords to be logged in server access logs and potentially exposed through browser history, Referer headers, and proxy logs. Version 1.16.1 patches the issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Produtos afetados
Quenary · tugtainerCVEs relacionadas — Quenary tugtainer
No mesmo produto, das mais perigosas para as menos.
CVE-2026-55494CRITICALTugtainer: Unauthenticated access to Tugtainer Agent Docker management APIs when AGENT_SECRET is unsetEPSS 0.6%CVE-2026-55181CRITICALTugtainer: OIDC login remains accessible when OIDC_ENABLED is falseEPSS 0.6%CVE-2025-69201HIGHTugtainer has RCE in Agent Command Execution ApiEPSS 0.5%CVE-2026-47752CRITICALTugtainer has Server-Side Template Injection in notification templates that leads to Remote Code ExecutionEPSS 0.4%CVE-2026-62308CRITICALTugtainer: Authenticated SSRF via arbitrary notification URLs in test_notification endpointEPSS 0.3%CVE-2026-87004HIGHTugtainer: OIDC id_token claims accepted without signature/audience/expiry verificationEPSS 0.3%