CVE-2026-55181: Tugtainer: OIDC login remains accessible when OIDC_ENABLED is false
Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.30.3, Tugtainer's OIDC authentication can still be initiated even when OIDCENABLED=false. The /auth/oidc/enabled endpoint correctly reports that OIDC is disabled. However, a direct request to /auth/oidc/login still starts the OIDC login flow, returns HTTP 302, sets an oidcstate cookie, and redirects the user to the configured OIDC authorization endpoint. This bypasses the intended OIDC disable switch. This issue has been patched in version 1.30.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Tugtainerto a version that resolves this vulnerability.Fixed in 1.30.3
Event History
Frequently Asked Questions
Which deployments are affected?
Tugtainer versions prior to 1.30.3 are affected if OIDC is configured. The issue occurs when OIDC_ENABLED is set to false, because the OIDC login endpoint remains directly accessible.
What does an attacker need to exploit this issue?
An attacker can send a direct request to /auth/oidc/login; no prior authentication or user interaction is required. The endpoint starts the OIDC flow, sets an oidc_state cookie, and redirects to the configured OIDC authorization endpoint.
How can I tell whether an instance is vulnerable?
On an affected instance with OIDC_ENABLED=false, /auth/oidc/enabled reports that OIDC is disabled, but a request to /auth/oidc/login returns HTTP 302 and redirects to the configured OIDC authorization endpoint. The response also sets an oidc_state cookie.
What is the remediation?
Upgrade Tugtainer to version 1.30.3, which patches the issue. Until upgrading, do not rely on OIDC_ENABLED=false alone to prevent access to the OIDC login flow.