Vulnerability · Published Jan 19, 2026 · Assigned by GitHub_M

CVE-2026-23846Tugtainer vulnerable to Password Exposure via URL Query Parameter

High 8.1

In plain English

A high-severity security flaw in tugtainer from Quenary. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)0.5%top 59.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Tugtainer is a self-hosted app for automating updates of Docker containers. In versions prior to 1.16.1, the password authentication mechanism transmits passwords via URL query parameters instead of the HTTP request body. This causes passwords to be logged in server access logs and potentially exposed through browser history, Referer headers, and proxy logs. Version 1.16.1 patches the issue.

Affected products (as reported)

Vendor	Product	Versions
Quenary	tugtainer	< 1.16.1

Weakness: CWE-598 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

References

https://github.com/Quenary/tugtainer/security/advisories/GHSA-f2qf-f544-xm4p x_refsource_CONFIRM
https://github.com/Quenary/tugtainer/commit/9d23bf40ac1d39005582abfcf0a84753a4e29d52 x_refsource_MISC