CVE-2026-23846

Tugtainer is a self-hosted app for automating updates of Docker containers. In versions prior to 1.16.1, the password authentication mechanism transmits passwords via URL query parameters instead of the HTTP request body. This causes passwords to be logged in server access logs and potentially exposed through browser history, Referer headers, and proxy logs. Version 1.16.1 patches the issue.

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/Quenary/tugtainer/commit/9d23bf40ac1d39005582abfcf0a84753a4e29d52	Patch
https://github.com/Quenary/tugtainer/security/advisories/GHSA-f2qf-f544-xm4p	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:quenary:tugtainer:*:*:*:*:*:docker:*:*

History

05 Feb 2026, 18:44

Type	Values Removed	Values Added
CPE		cpe:2.3:a:quenary:tugtainer::::::docker::*
References	~~() https://github.com/Quenary/tugtainer/commit/9d23bf40ac1d39005582abfcf0a84753a4e29d52 -~~	() https://github.com/Quenary/tugtainer/commit/9d23bf40ac1d39005582abfcf0a84753a4e29d52 - Patch
References	~~() https://github.com/Quenary/tugtainer/security/advisories/GHSA-f2qf-f544-xm4p -~~	() https://github.com/Quenary/tugtainer/security/advisories/GHSA-f2qf-f544-xm4p - Exploit, Vendor Advisory
First Time		Quenary tugtainer Quenary

19 Jan 2026, 20:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-01-19 20:15

Updated : 2026-02-05 18:44

NVD link : CVE-2026-23846

Mitre link : CVE-2026-23846

CVE.ORG link : CVE-2026-23846

JSON object : View

Products Affected

quenary

tugtainer

CWE

CWE-598

Use of GET Request Method With Sensitive Query Strings

{"id": "CVE-2026-23846", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 3.9}]}, "published": "2026-01-19T20:15:49.243", "references": [{"url": "https://github.com/Quenary/tugtainer/commit/9d23bf40ac1d39005582abfcf0a84753a4e29d52", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/Quenary/tugtainer/security/advisories/GHSA-f2qf-f544-xm4p", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-598"}]}], "descriptions": [{"lang": "en", "value": "Tugtainer is a self-hosted app for automating updates of Docker containers. In versions prior to 1.16.1, the password authentication mechanism transmits passwords via URL query parameters instead of the HTTP request body. This causes passwords to be logged in server access logs and potentially exposed through browser history, Referer headers, and proxy logs. Version 1.16.1 patches the issue."}], "lastModified": "2026-02-05T18:44:54.550", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:quenary:tugtainer:*:*:*:*:*:docker:*:*", "vulnerable": true, "matchCriteriaId": "B0EB5A8E-D461-4035-93D7-007BF202F58D", "versionEndExcluding": "1.16.1"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}