CVE-2026-87004 Tugtainer: OIDC id_token claims accepted without signature/audience/expiry verification
Attackers can bypass OIDC authentication in Tugtainer by forging unsigned id_tokens, gaining unauthorized access to the container automation platform.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-87004?
CVE-2026-87004 is a high-severity authentication bypass vulnerability in Quenary tugtainer, published on 30 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.31.3, when the OIDC login flow completes, backend/modules/auth/providers/auth_oidc_provider.py decodes the id_token returned by the identity provider's token endpoint using jose.jwt.get_unverified_claims() instead of jwt.decode(). This skips signature verification, audience (aud) validation, issuer (iss) validation, and expiry (exp) checking entirely. The extracted claims (email/sub/preferred_username) are then used directly as the user_id for the resulting Tugtainer session. This issue has been patched in version 1.31.3.
Weakness: CWE-347
Which versions are affected by CVE-2026-87004?
How do I fix CVE-2026-87004?
No fix has been published for CVE-2026-87004 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-87004 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-87004 exists.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-crjc-6vc7-xrfh.