CVE-2026-23846: Tugtainer vulnerable to Password Exposure via URL Query Parameter
Tugtainer is a self-hosted app for automating updates of Docker containers. In versions prior to 1.16.1, the password authentication mechanism transmits passwords via URL query parameters instead of the HTTP request body. This causes passwords to be logged in server access logs and potentially exposed through browser history, Referer headers, and proxy logs. Version 1.16.1 patches the issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23846?
CVE-2026-23846 is considered a high severity vulnerability due to its potential for password exposure.
How do I fix CVE-2026-23846?
To fix CVE-2026-23846, upgrade to Tugtainer version 1.16.1 or later where the password transmission issue has been addressed.
What specific vulnerability does CVE-2026-23846 address?
CVE-2026-23846 addresses the vulnerability of password exposure occurring through URL query parameters in Tugtainer.
Which versions of Tugtainer are affected by CVE-2026-23846?
Tugtainer versions prior to 1.16.1 are affected by CVE-2026-23846.
What potential issues could arise from CVE-2026-23846 in my application?
CVE-2026-23846 could lead to unauthorized access as passwords can be easily intercepted if transmitted via URL query parameters.