CVE-2026-23846 Tugtainer vulnerable to Password Exposure via URL Query Parameter
Attackers can recover passwords from logs or browser history because Tugtainer sends credentials in URL query parameters.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-23846?
CVE-2026-23846 is a high-severity vulnerability in Quenary tugtainer, published on 19 Jan 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Tugtainer is a self-hosted app for automating updates of Docker containers. In versions prior to 1.16.1, the password authentication mechanism transmits passwords via URL query parameters instead of the HTTP request body. This causes passwords to be logged in server access logs and potentially exposed through browser history, Referer headers, and proxy logs. Version 1.16.1 patches the issue.
Weakness: CWE-598
Which versions are affected by CVE-2026-23846?
It affects 1 product.
Products include Quenary Tugtainer.
How do I fix CVE-2026-23846?
No fix has been published for CVE-2026-23846 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-23846 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-23846 exists.
Other vulnerabilities in Quenary tugtainer
Sources
Also known as GHSA-f2qf-f544-xm4p.