Quenary tugtainer up to 1.16.0 get request method with sensitive query strings

Summaryinfo

A vulnerability identified as critical has been detected in Quenary tugtainer up to 1.16.0. The affected element is an unknown function. This manipulation causes use of get request method with sensitive query strings. This vulnerability is registered as CVE-2026-23846. Remote exploitation of the attack is possible. No exploit is available. You should upgrade the affected component.

Detailsinfo

A vulnerability classified as critical was found in Quenary tugtainer up to 1.16.0. Affected by this vulnerability is some unknown functionality. The manipulation with an unknown input leads to a use of get request method with sensitive query strings vulnerability. The CWE definition for the vulnerability is CWE-598. The web application uses the HTTP GET method to process a request and includes sensitive information in the query string of that request. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Tugtainer is a self-hosted app for automating updates of Docker containers. In versions prior to 1.16.1, the password authentication mechanism transmits passwords via URL query parameters instead of the HTTP request body. This causes passwords to be logged in server access logs and potentially exposed through browser history, Referer headers, and proxy logs. Version 1.16.1 patches the issue.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-23846 since 01/16/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. It demands that the victim is doing some kind of user interaction. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 1.16.1 eliminates this vulnerability. Applying the patch 9d23bf40ac1d39005582abfcf0a84753a4e29d52 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-3294). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• Quenary

Name

• tugtainer

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10
• 1.11
• 1.12
• 1.13
• 1.14
• 1.15
• 1.16.0

License

• open-source

Website

• Product: https://github.com/Quenary/tugtainer/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion