Critical severity · published Jan 19, 2026
CVE-2026-23846
Tugtainer vulnerable to Password Exposure via URL Query Parameter
9.1
CVSS
0.5%
EPSS
No
On KEV
Description
Tugtainer is a self-hosted app for automating updates of Docker containers. In versions prior to 1.16.1, the password authentication mechanism transmits passwords via URL query parameters instead of the HTTP request body. This causes passwords to be logged in server access logs and potentially exposed through browser history, Referer headers, and proxy logs. Version 1.16.1 patches the issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 40% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TU
tugtainer · Quenary
< 1.16.1 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-23846
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-23846
Patch
https://github.com/Quenary/tugtainer/commit/9d23bf40ac1d39005582abfcf0a84753a4e29d52
Exploit
https://github.com/Quenary/tugtainer/security/advisories/GHSA-f2qf-f544-xm4p
More from tugtainer
9.9
CVE-2026-47752
Tugtainer has Server-Side Template Injection in notification templates that leads to Remote Code Execution
9.8
CVE-2026-55494
Tugtainer: Unauthenticated access to Tugtainer Agent Docker management APIs when AGENT_SECRET is unset
9.8
CVE-2025-69201
Tugtainer has RCE in Agent Command Execution Api
9.4
CVE-2026-55181
Tugtainer: OIDC login remains accessible when OIDC_ENABLED is false
9.1
CVE-2026-62308
Tugtainer: Authenticated SSRF via arbitrary notification URLs in test_notification endpoint