CVE-2026-23846

Published: Jan 19, 2026Modified: Jun 17, 2026

9.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Exploitability: 3.9 / Impact: 5.2

Source: NVD

Description

Tugtainer is a self-hosted app for automating updates of Docker containers. In versions prior to 1.16.1, the password authentication mechanism transmits passwords via URL query parameters instead of the HTTP request body. This causes passwords to be logged in server access logs and potentially exposed through browser history, Referer headers, and proxy logs. Version 1.16.1 patches the issue.

Affected (1)

Products: Quenary: Tugtainer

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Quenary Tugtainer	Before 1.16.1

Related CWEs

Use of GET Request Method With Sensitive Query Strings

The web application uses the HTTP GET method to process a request and includes sensitive information in the query string of that request.

References (2)

https://github.com/Quenary/tugtainer/commit/9d23bf40ac1d39005582abfcf0a84753a4e29d52

Source: security-advisories@github.com

Patch

https://github.com/Quenary/tugtainer/security/advisories/GHSA-f2qf-f544-xm4p

Source: security-advisories@github.com

ExploitVendor Advisory

Timeline

No history available yet.