PT-2026-3491 · Tugtainer · Tugtainer

Thxtech · Publicado 2026-01-19 · Atualizado 2026-01-20 · CVE-2026-23846

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Tugtainer versions prior to 1.16.1

Description Tugtainer is a self-hosted application designed for automating updates of Docker containers. Prior to version 1.16.1, the password authentication process transmits passwords through URL query parameters rather than utilizing the HTTP request body. This practice results in passwords being recorded in server access logs and potentially exposed via browser history, Referer headers, and proxy logs.

Recommendations Update Tugtainer to version 1.16.1 or later.

Exploit

Correção

Enumeração de Fraquezas

CWE-598

Identificadores relacionados

CVE-2026-23846

GHSA-F2QF-F544-XM4P

Produtos afetados

Tugtainer

Referências · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23846.json · Exploit
• https://github.com/Quenary/tugtainer/commit/9d23bf40ac1d39005582abfcf0a84753a4e29d52 · Correção
• https://github.com/Quenary/tugtainer/security/advisories/GHSA-f2qf-f544-xm4p · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/2013406222762881423 · Publicação no Twitter
• https://twitter.com/TheHackerWire/status/2013351081640894945 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2013338857006407920 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-23846 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-23846 · Nota de Segurança