CVE-2026-55494: Tugtainer: Unauthenticated access to Tugtainer Agent Docker management APIs when AGENT_SECRET is unset
Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.30.4, Tugtainer Agent allows unauthenticated access to Docker management APIs when AGENTSECRET is not configured. The Agent uses request signatures to protect its API routes. However, in agent/auth.py, the signature verification function returns successfully if Config.AGENTSECRET is empty. This causes protected Agent APIs to become accessible without authentication. This issue has been patched in version 1.30.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Tugtainer Agentto a version that resolves this vulnerability.Fixed in 1.30.4
Event History
Frequently Asked Questions
Which deployments are exposed?
Tugtainer Agent deployments running a version before 1.30.4 are exposed if AGENT_SECRET is unset or empty. The issue affects the Agent's Docker management API routes.
What does an attacker need to exploit this issue?
An attacker only needs network access to the affected Agent API. No authentication, privileges, or user interaction are required when AGENT_SECRET is empty.
How can I determine whether my deployment is affected?
Check whether the Tugtainer Agent version is earlier than 1.30.4 and whether AGENT_SECRET is configured with a non-empty value. If both conditions apply, protected Agent API routes may be accessible without request-signature authentication.
What should I do if I cannot upgrade immediately?
Configure AGENT_SECRET with a non-empty value to ensure request-signature verification is enforced. Upgrade to version 1.30.4 when possible.