PT-2026-3491 · Tugtainer · Tugtainer

Thxtech · CVE-2026-23846 · Published 2026-01-19 · Updated 2026-01-20

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Tugtainer versions prior to 1.16.1

Description Tugtainer is a self-hosted application designed for automating updates of Docker containers. Prior to version 1.16.1, the password authentication process transmits passwords through URL query parameters rather than utilizing the HTTP request body. This practice results in passwords being recorded in server access logs and potentially exposed via browser history, Referer headers, and proxy logs.

Recommendations Update Tugtainer to version 1.16.1 or later.

Exploit

Fix

Weakness Enumeration

CWE-598

Related Identifiers

CVE-2026-23846

GHSA-F2QF-F544-XM4P

Affected Products

Tugtainer

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23846.json · Exploit
• https://github.com/Quenary/tugtainer/commit/9d23bf40ac1d39005582abfcf0a84753a4e29d52 · Patch
• https://github.com/Quenary/tugtainer/security/advisories/GHSA-f2qf-f544-xm4p · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-23846 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23846 · Security Note
• https://twitter.com/VulmonFeeds/status/2013406222762881423 · Twitter Post
• https://twitter.com/TheHackerWire/status/2013351081640894945 · Twitter Post
• https://twitter.com/CVEnew/status/2013338857006407920 · Twitter Post