CVE-2026-23846

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23846", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-16T15:46:40.843Z", "datePublished": "2026-01-19T19:42:35.581Z", "dateUpdated": "2026-01-20T14:40:03.105Z"}, "containers": {"cna": {"title": "Tugtainer vulnerable to Password Exposure via URL Query Parameter", "problemTypes": [{"descriptions": [{"cweId": "CWE-598", "lang": "en", "description": "CWE-598: Use of GET Request Method With Sensitive Query Strings", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/Quenary/tugtainer/security/advisories/GHSA-f2qf-f544-xm4p", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/Quenary/tugtainer/security/advisories/GHSA-f2qf-f544-xm4p"}, {"name": "https://github.com/Quenary/tugtainer/commit/9d23bf40ac1d39005582abfcf0a84753a4e29d52", "tags": ["x_refsource_MISC"], "url": "https://github.com/Quenary/tugtainer/commit/9d23bf40ac1d39005582abfcf0a84753a4e29d52"}], "affected": [{"vendor": "Quenary", "product": "tugtainer", "versions": [{"version": "< 1.16.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-19T19:42:35.581Z"}, "descriptions": [{"lang": "en", "value": "Tugtainer is a self-hosted app for automating updates of Docker containers. In versions prior to 1.16.1, the password authentication mechanism transmits passwords via URL query parameters instead of the HTTP request body. This causes passwords to be logged in server access logs and potentially exposed through browser history, Referer headers, and proxy logs. Version 1.16.1 patches the issue."}], "source": {"advisory": "GHSA-f2qf-f544-xm4p", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-20T14:39:41.231564Z", "id": "CVE-2026-23846", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-20T14:40:03.105Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-23846", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-20T14:39:41.231564Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-20T14:39:55.824Z"}}], "cna": {"title": "Tugtainer vulnerable to Password Exposure via URL Query Parameter", "source": {"advisory": "GHSA-f2qf-f544-xm4p", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "Quenary", "product": "tugtainer", "versions": [{"status": "affected", "version": "< 1.16.1"}]}], "references": [{"url": "https://github.com/Quenary/tugtainer/security/advisories/GHSA-f2qf-f544-xm4p", "name": "https://github.com/Quenary/tugtainer/security/advisories/GHSA-f2qf-f544-xm4p", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/Quenary/tugtainer/commit/9d23bf40ac1d39005582abfcf0a84753a4e29d52", "name": "https://github.com/Quenary/tugtainer/commit/9d23bf40ac1d39005582abfcf0a84753a4e29d52", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Tugtainer is a self-hosted app for automating updates of Docker containers. In versions prior to 1.16.1, the password authentication mechanism transmits passwords via URL query parameters instead of the HTTP request body. This causes passwords to be logged in server access logs and potentially exposed through browser history, Referer headers, and proxy logs. Version 1.16.1 patches the issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-598", "description": "CWE-598: Use of GET Request Method With Sensitive Query Strings"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-19T19:42:35.581Z"}}}, "cveMetadata": {"cveId": "CVE-2026-23846", "state": "PUBLISHED", "dateUpdated": "2026-01-20T14:40:03.105Z", "dateReserved": "2026-01-16T15:46:40.843Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-01-19T19:42:35.581Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "tugtainer", "vendor": "Quenary", "versions": [{"status": "affected", "version": "< 1.16.1"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:quenary:tugtainer:*:*:*:*:*:docker:*:*", "matchCriteriaId": "B0EB5A8E-D461-4035-93D7-007BF202F58D", "versionEndExcluding": "1.16.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Tugtainer is a self-hosted app for automating updates of Docker containers. In versions prior to 1.16.1, the password authentication mechanism transmits passwords via URL query parameters instead of the HTTP request body. This causes passwords to be logged in server access logs and potentially exposed through browser history, Referer headers, and proxy logs. Version 1.16.1 patches the issue."}, {"lang": "es", "value": "Tugtainer es una aplicaci\u00f3n autoalojada para automatizar actualizaciones de contenedores Docker. En versiones anteriores a la 1.16.1, el mecanismo de autenticaci\u00f3n de contrase\u00f1a transmite contrase\u00f1as a trav\u00e9s de par\u00e1metros de consulta de URL en lugar del cuerpo de la solicitud HTTP. Esto provoca que las contrase\u00f1as se registren en los registros de acceso del servidor y se expongan potencialmente a trav\u00e9s del historial del navegador, los encabezados Referer y los registros de proxy. La versi\u00f3n 1.16.1 corrige el problema."}], "id": "CVE-2026-23846", "lastModified": "2026-06-17T10:22:11.783", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-23846", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-20T14:39:41.231564Z", "version": "2.0.3"}}]}, "published": "2026-01-19T20:15:49.243", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/Quenary/tugtainer/commit/9d23bf40ac1d39005582abfcf0a84753a4e29d52"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/Quenary/tugtainer/security/advisories/GHSA-f2qf-f544-xm4p"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-598"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T05:01:17.104177+00:00", "value": {"mitigation_remediation": ["Upgrade Quenary Tugtainer to version\u202f1.16.1 or later.", "Immediately purge any server access logs, browser histories, or proxy logs that may contain the exposed passwords.", "Restrict read and write permissions on log files to prevent unauthorized access, and configure logging to exclude URL query parameters.", "As a temporary countermeasure, disable password authentication or replace it with a token\u2011based or certificate\u2011based authentication method until the patch is applied.", "Enforce HTTPS for all communication to prevent eavesdropping of authentication traffic."], "summary": {"action": "Apply patch", "impact": "Password credential exposure"}, "threat_synthesis": {"affected_systems": "The vulnerability affects all installations of Quenary Tugtainer versions earlier than 1.16.1. Administrators should review any deployment that has not been updated to 1.16.1 or later, regardless of the operating environment, as the flaw is present in all such releases.", "description_and_impact": "Tugtainer, a self\u2011hosted Docker container automation tool, contains an authentication flaw in versions older than 1.16.1. The password supplied for authentication is appended to the request URL as a query string rather than being placed in the request body. Because the URL is logged by the server, it may appear in access logs, browser history, Referer headers, and proxy logs, resulting in the disclosure of user credentials. This weakness aligns with CWE\u2011598 \u2013 Exposing Sensitive Information Through an Improper Transfer Mechanism.", "risk_and_exploitability": "The CVSS score of 8.1 indicates high severity, yet the EPSS score of less than 1\u202f% suggests a low probability of exploitation. The vulnerability is not included in the CISA KEV catalog. Exploitation would most likely be passive, with an attacker gleaning credentials from server logs, search histories, or forwarded Referer headers. No direct remote code execution or privilege escalation is possible, but the exposure of authentication secrets can lead to account compromise, unauthorized access to container registries, and potential lateral movement within an environment."}}}}, "created": "2026-01-20T08:40:34.946526+00:00", "updated": "2026-04-18T05:15:15.969484+00:00", "vendors": ["quenary", "quenary$PRODUCT$tugtainer"]}